Sablier

Summary

The creation of streams using WETH as stream token will fail in some chains.

Vulnerability Details

The creation of streams is usually done when _create is called in the SablierV2LockupLinear.sol and the transfer of the assets that will be distributed during the stream is made as can be seen below:

The method used is the safetransferFrom method, which will work fine on most chains which uses the standard WETH9 contract that handles the case when src=msg.sender

The problem is that the WETH implementation on Blast uses a different contract and does not have this src == msg.sender handling.
According to the documentation, the use of normal ERC20 tokens is supported across all chains and WETH is a very popular ERC20 token. The protocol prohibits the use of Ether not WETH and intends on deploying on all chains.
As can be seen in the docs below:

Sablier protocol is compatible with the following:
Any network which is EVM compatible,
Any ERC20 token
Its not compatible with:
Any network which is not EVM compatible,
Any token standard other than ERC20,
Rebased ERC20 tokens can be used but yield will be lost,
Ether (ETH)

Impact

The problem is that the WETH implementation on Blast uses a different contract and does not have this src == msg.sender handling.
The failure to approve the SablierV2LockupLinear.sol to spend WETH tokens will prevent the protocol from creating WETH streams on multiple chains like Blast.

Tools Used

Manual review

Recommendations

To address this issue, it is recommended to modify the SablierV2LockupLinear.sol and other stream creating contracts file as follows: