Sablier

Impact

The JSON payload of the NFT representing the stream is partially broken

Proof of concept

The NFT tokenURI is a JSON payload that includes the underlying ERC20 token's symbol in multiple places.

The format of a JSON payload is composed of double quotes (") to represent the keys ({"key" : ...}) of the data but also the data itself when it is a string ({"key" : "I am a string"}).

Injecting a " in the data string can mess up the JSON payload due to an un-equivalent number of double quotes, potentially making it impossible to parse or even worse, changing the payload itself which could lead to honey-pot attacks, phishing attacks...

Since the SablierV2NFTDescriptor::safeAssetSymbol() function replaces the ERC20 token symbol in case it is too big, the surface attack is restricted but the fact that the tokenURI can be broken MUST be considered.

The below is a proof of concept that demonstrates what an attacker could do by creating an ERC20 token with a malicious symbol.

Modify the symbol of the Mock ERC20 token in v2-core/test/Base.t.sol on line 58 like such (pick one or the other) :

Add the following test to v2-core/test/integration/concrete/lockup-dynamic/token-uri/tokenURI.t.sol

The test will write the JSON payload of the NFT in v2-core/broken.json which we can open in our browser (Firefox) and notice it is malformed

Recommended mitigation steps

Modifiy the SablierV2NFTDescriptor::safeAssetSymbol() function to make sure it escapes every special characters in the token symbol and token name, especially the \ and " characters