Sablier

Vulnerability Details

From documentation link The broker fee is a percentage of the streamed amount. When create new stream, all broker fee are transfered for broker in all type of stream:

function _create(LockupLinear.CreateWithTimestamps memory params) internal returns (uint256 streamId) {
  .   .   .   .   .   .   .   .   .
    // Interaction: pay the broker fee, if not zero.
    if (createAmounts.brokerFee > 0) {
        params.asset.safeTransferFrom({ from: msg.sender, to: params.broker.account, value: createAmounts.brokerFee });
    }
  .   .   .   .   .   .   .   .   .
}

But when stream is canceled, none of the fee is transfered back for stream creator, which lead to broker fee is overpaid.

Impact

Broker fee is overpaid

Tools Used

Manual review

Recommendations

Instead of directly transfer fee for broker, consider mint another stream for broker.