Sablier

Summary

In _calculateStreamedAmount function of SablierV2LockupLinear contract, the start timestamp of the stream is not checked versus current timestamp, which leads to overflow in math and as a result some functionalities do not work.

Vulnerability Details

In _calculateStreamedAmount function, the calculation of streamed amount is done in unchecked block.

Since the validity of startTime is not checked in the function, so startTime can surely be bigger than blockTimestamp. For information, there's a validation of cliffTime but it is usually zero when there is no cliff time.

As a result, overflow in math occurs and elapsedTime will be near to type(uint256).max, and this big number causes a revert in div function because of overflow.

This means _calculateStreamedAmount function reverts when startTime > blockTimestamp`.

Impact

The issue specifically prevents senders from cancelling the stream before it starts.

Tools Used

Manual Review

Recommendations

There should be a validation where it returns zero if a stream is not started.