Sablier

Summary

Because the merkle lockup contract uses post-payment structure, any user can deposit tokens to the contract to initiate grace period.

Vulnerability Details

The grace period of airstream contracts exists to give opportunities for the admins to cancel the airdrops within 1 week of airdrop periods in case there happens a mistake in airdrop.
With current structure, the grace period is started when the first claim happens, also it sholdn't be started as long as the admins don't deposit funds into the contract.
However, a malicious actor can donate some funds to the contract to start grace period earlier than expected, which might causes for admins to lose opportunities to clawback before grace periods ends.

Impact

The admin of the contract might not be able to cancel the airdrop and get the token back.

Tools Used

Manual Review

Recommendations

There should be a deposit function which is callable by the admin where it starts grace period.