Sablier

Description

inside SablierV2Lockup.sol function burn is called whenever a stream needs to be burned:

A check ensures that only depleted streams can be burned, providing a safety measure for the recipient, so their stream cannot be burned if it still contains withdrawable funds.

After going through the check, the ERC721 Burn function gets called. Note that the function does not check if the sender is authorized to operate on the token:

This means that granted roles are allowed to call this function for the recipient. This makes sense this an approved third is allowed to call burn as the comments state:

Impact

However, unlike functions such as _cancel, the burn function cannot be called by the stream sender, as it lacks the _IsCallerStreamSender check. This is illogical, as the creator of a stream should have the authority to burn their own created stream. As of now a recipient can choose to never burn his stream which can lead to an overpopulated array of streamid's

Tools Used

Manual Review

Recommendation

make sure to add the _isCallerStreamSender role to the burn function.