Sablier

Summary

The access control for operator is missing in withdrawMaxAndTransfer function

Vulnerability Details

When the NFT should be transferred to other recipient, usually maximum amount will be withdrawn before the NFT is actually transferred.
Currently, in the protocol, there's two ways to achieve this action:

1. Call withdrawMax and then call transferFrom.

2. Call withdrawMaxAndTransfer.

The approved operator can take the first way since they have permission in both withdrawMax and transferFrom functions, but they can't take the second way because of lack of permission.

Impact

Logic mismatch and kind of DoS

Tools Used

Manual Review

Recommendations

Operators should be allowed to call withdrawMaxAndTransfer