Sablier

Summary

The SablierV2Lockup::withdrawMaxAndTransfer function transfers the streamId to the new recipient. But it does not check whether the recipient can receive NFT. This might lock the NFT in the contract.

Vulnerability Details

The SablierV2Lockup::withdrawMaxAndTransfer function transfers the streamId from the currentRecipient to the newRecipient bby direct call of the ERC721::_transfer function. This function does not check whether the recipient can receive ERC721 tokens. This can be fixed by using ERC721::_transfer. However, ERC721::_transfer might introduce a reentrancy, so it hould be used together with a reentrancy guard.

Impact

If the recipient of the streamId can not receive NFT, than the streamId NFT will be locked in the recipient contract forever and the stream will become unusable.

Tools Used

Manual Review

Recommendations

Use ERC721::_safeTransfer with a reentrancy guard instead of ERC721::_transfer to be sure that the recipient can receive NFT.