Sablier

Summary

Since the protocol does not check if the asset is fee-on-transfer tokens, which results in mismatches between the deposit amounts and actual amounts moved to the contract

Vulnerability Details

In _create function of linear, dynamic, and tranched lockup contracts, it transfers tokens from the stream creator to the contract given the deposit amount from the parameter.
However, it does not check if the actual amount of token is moved over after the token transfer, which might be less than expected for fee-on-transfer tokens.

Impact

Because the actual moved amount is less than the deposit amount, the core protocol actions like withdraw or cancel will not work because of lack of tokens in the protocol.

Tools Used

Manual Review

Recommendations

Implement pre/post amount check logic for asset transfers.