it is possible to make payments that start in the past
Summary
when creating payments with function createWithTimestamps it is possible to make payments that start in the past.
Vulnerability Details
when creating payments with function createWithTimestamps(LockupDynamic.CreateWithTimestamps calldata params) in SablierV2LockupDynamic there is no check to assert that the params.startTime is not less than block.timestamp in Helpers.sol. This also applies to SablierV2LockupLinear and SablierV2LockupTranched.
Impact
the effect of this vulnerability is not high but it can be used by an attacker to amplify or quicker the damage from another vulnerability.
Tools Used
Manual Audit
Recommendations
ensure that the startTime is not less that the block.timestamp
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.