Summary

Generally all createWithDurations()functions are used to create a stream by setting the start time to block.timestamp, and the end time to the sum of block.timestamp and all specified time durations. The segment timestamps are derived from these durations. The stream is then funded by msg.sender and is wrapped in an ERC-721 NFT.

Problem however is that implementations of the createWithDurations() never seem to set the end duration as hinted to be done in the docs.

Vulnerability Details

For example, take a look at this implementation in the SablierV2LockupDynamic : https://github.com/Cyfrin/2024-05-Sablier/blob/43d7e752a68bba2a1d73d3d6466c3059079ed0c6/v2-core/src/SablierV2LockupDynamic.sol#L138-L162

Evidently, this function does everything it's expected to do as hinted by asides setting the end duration.

NB: This is also applicable to all subtle wrappers that create these streams without setting a valid end duration like in SablierV2LockupDynamic#createWithDurations().

Impact

streams are created without specifying the end duration.

Tools Used

Manual review

Recommendations

Consider executing the creation of creating the streams while correctly setting the end duration.