Summary

In the current code flow, the assumption is made such that all the ERC20 assets will have 18 decimal.

But this is not valid for all the scenario. for example the following token will have less than 18 decimal.

USDC (USD Coin), USDT (Tether) , GUSD (Gemini Dollar), TUSD (TrueUSD).

Vulnerability Details

In the current code, the broker fee percentages is decided with 18 decimal values.

https://github.com/Cyfrin/2024-05-Sablier/blob/43d7e752a68bba2a1d73d3d6466c3059079ed0c6/v2-core/src/abstracts/SablierV2Lockup.sol#L35-L37

Impact

More amount of base token have to be deposited by the stream sender when they consider the broker fee.

in other words, they have to pay hefty amount of broken fee.

Tools Used

Manual review.

Recommendations

We would suggest to set the MAX_BROKER_FEE inside the constructor based on base asset decimal.