Flow

location: /src/abstracts/SablierFlowBase.sol

Description: The recover function allows the admin to transfer surplus tokens but does not verify if the admin has the required approval to transfer tokens, especially if the token is an ERC20 contract.

• Code Reference:

Impact:

• If the contract does not have enough balance or approval to make the transfer, it will fail, leading to failed transactions.

• Recommendations:

  • Ensure that the contract holds enough tokens by checking the balance before the transfer, or add a mechanism to approve the contract for token transfers:

    require(token.balanceOf(address(this)) >= surplus, "Insufficient contract balance");