Clawback cannot recover funds after expirtation, leading to loss of funds
Summary
clawback cannot recover unused funds after expiration period has passed due to hasExpired condition.
https://github.com/Cyfrin/2024-05-Sablier/blob/43d7e752a68bba2a1d73d3d6466c3059079ed0c6/v2-periphery/src/abstracts/SablierV2MerkleLockup.sol#L93
Vulnerability Details
If airdrop is not claimed fully by airdrop receivers for any reason and expiration has happened, funds are locked in protocol and cannot be claimed neither through clawback nor through claim due to _checkClaim check.
https://github.com/Cyfrin/2024-05-Sablier/blob/43d7e752a68bba2a1d73d3d6466c3059079ed0c6/v2-periphery/src/abstracts/SablierV2MerkleLockup.sol#L131
This will leave funds locked in airdrop contract permanently.
Impact
Medium - loss of funds under specific conditions.
Tools Used
Manual review.
Recommendations
Relax expiration conditions for either claim or preferrably clawback
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.