Sablier

Summary

Approved operator can not use withdrawMaxAndTransfer function.

Vulnerability Details

By definition of EIP721, the approved operator has full rights to manage the owner’s asset. In the context of Sablier, the withdrawMaxAndTransfer function operator is limited because they do not have the rights to withdraw all funds and transfer the stream.

Impact

This can be a significant limitation if the owner is a multi-sig wallet used only to create streams, with each stream distributed to other people who actually control and operate with the streaming funds.

Tools Used

Manual Review

Recommendations

An approved operator should also have the right to call the withdrawMaxAndTransfer function.