Sablier

Summary

Calling _mint() does not ensure that the receiver of the NFT is able to accept them.

Vulnerability Details

As stated in the docs, The transferability of the NFT makes Sablier streams tradable and usable as collateral in DeFi.
However, SablierV2LockupLinear.sol, SablierV2LockupDynamic.sol and SablierV2LockupTranched.sol uses _mint() which does not ensure that ERC721 tokens are only minted to addresses which support them.
This is not an issue if the receiver's goal is to withdraw the stream. However, if their goal is to trade the NFT or use it as collateral, they will not be able to do so because they won't be able to transfer the ERC721 token.

Impact

If the receiver aims to use the NFT as collateral or trade it, but their address doesn't support ERC721 tokens, they won’t be able to transfer it or interact with DeFi protocols.

Tools Used

Manual review

Recommendations

Use _safeMint() instead of mint()