Sablier

Summary

Merkle lockup contract uses CREATE0 for creating lockup contracts via the factory contract, and this is vulnerable to reorg attack

Vulnerability Details

The airstream creators use the merkle lockup factory contract to create airdrop contracts, and then deposit funds to the created merkle lockup contracts.
Abusing this vulnerability, when an reorg happens in the EVM(presumably in Polygon), an attacker can front-run to create a lockup contract before the original creator which will result in the same address as original one, and the original creator might send the funds to the address that the attacker has control of.

Impact

The creators of airdrop contracts lose funds

Tools Used

Manual Review

Recommendations

Use CREATE2 for deterministic address, or create deposit function which is only callable by admin that deposits funds to the contract.