Summary

A sender can create a non-withdrawable stream by abusing the unlimited gas on the SablierV2Lockup.sol::onLockupStreamWithdrawn hook and the updateMetadata modiefier

Vulnerability Details

Similarly to the finding 3.2.1 in the previous audit, the sender can create a callback that will revert the withdraw function due to OOG.

Impact

Receivers can be fooled and never withdraw their tokens due to the DoS caused by the OOG that can occur if the sender create a too expensive onLockupStreamWithdrawn callback.

Tools Used

manual review

Recommendations

Same as previous audit. Change the updateMetadata modifier to emit events before the function be executed, not after.