Summary

As WETH implemented differently in some platform like BLAST, ARBITRUM. Some current codebase will not compatible for WTH in those chains.

Vulnerability Details

Contest ReadMe says that Sablier protocol is compatible with

• Any network which is EVM compatible

• Any ERC20 token

So considering that BLAST - Blast is an EVM-compatible Ethereum layer 2 platform that offers native yield for ether and stablecoins.

And WETH is ERC20 which in implemented slightly differently on BLAST, Explaining below ::

SablierV2LockupLinear._create() function has below code which used to fetch ERC20 token from msg.sender to that contract address and to send same ERC20 token to feeBrokerAccount

https://github.com/Cyfrin/2024-05-Sablier/blob/main/v2-core/src/SablierV2LockupLinear.sol#L277-L282

In fact same segment of code present in SablierV2LockupTranched._create() & SablierV2LockupDyanamic._create() as well
https://github.com/Cyfrin/2024-05-Sablier/blob/main/v2-core/src/SablierV2LockupTranched.sol#L261-L266
https://github.com/Cyfrin/2024-05-Sablier/blob/main/v2-core/src/SablierV2LockupDynamic.sol#L357-L362

However, the transfer done using address(weth).transferFrom. This works fine on most chains (Ethereum, Optimism, Polygon, BSC) which uses the standard WETH9 contract that handles the case when src == msg.sender:

The problem is that the WETH implementation on Blast uses a different contract, and does not have this src == msg.sender handling.

Also, the issue is presented in Wrapped Arbitrum and Wrapped Fantom.

Impact

Due to special behaviour of weth.transferFrom() in BLAST , ARBITRUM & FANTOM, current implementation is not supported in those networks.

Tools Used

Manual Review

Recommendations

Try to use trasfer() instead of transferFrom()