Sablier

Summary

sender can cancel the stream before cliff to rob the money from receiver,
since before cliff, the _calculateStreamedAmount return 0.

Vulnerability Details

according to the describe about cliff:

though assets continue to accrue in the stream, which means this part of assets should belong to the receiver,
only after cliff, receiver can withdraw the rewards.

The issue is, sender can cancel the stream before cliff, and the _calculateStreamedAmount return 0,
whicih means receiver can not get any rewards once sender cancel the stream before cliff.

The part of asset accure in stream before cliff should belong to receiver,

Impact

The receiver can not get any rewards once sender cancel the stream before cliff.

Tools Used

manual

Recommendation

limit the ability of sender to cancel the stream before cliff