Sablier

Summary

The clawback function in the SablierV2MerkleLockup contract has a logical flaw that contradicts the requirements specified in the ISablierV2MerkleLockup interface which it inherits. The current implementation is more restrictive than intended, potentially preventing legitimate clawback operations.

Vulnerability details

The clawback function in the SablierV2MerkleLockup contract checks if the grace period has passed AND if the campaign has not expired. If both conditions are true, it reverts the transaction. This logic contradicts the interface documentation, which specifies that the clawback should be allowed if any of the following conditions are met:

• No claim has been made.

• The current timestamp is within 7 days after the first claim.

• The campaign has expired.

Interface Definition

https://github.com/Cyfrin/2024-05-Sablier/blob/43d7e752a68bba2a1d73d3d6466c3059079ed0c6/v2-periphery/src/interfaces/ISablierV2MerkleLockup.sol#L68-L81

But the implementation doesn't follow that:

https://github.com/Cyfrin/2024-05-Sablier/blob/43d7e752a68bba2a1d73d3d6466c3059079ed0c6/v2-periphery/src/abstracts/SablierV2MerkleLockup.sol#L109

Impact

The restrictive logic in the clawback function may prevent legitimate clawback operations, potentially locking funds that should be reclaimable under the conditions specified in the interface documentation. The current implementation only allows clawback if the grace period has not passed or the campaign has expired, which is more restrictive than the interface requirements.

Tools Used

Manual review

Recommendations

Update the clawback function logic to align with the interface documentation.