Flow

Summary

It doesn't make sense to create a stream between sender and receiver as same address. So a malicious actor will create many streams by giving same sender address as receiver

Vulnerability Details

https://github.com/Cyfrin/2024-10-sablier/blob/8a2eac7a916080f2022527408b004578b21c51d0/src/SablierFlow.sol#L216

In SablierFlow.sol::create() a user can create a stream between any two entities. A malicious person will spam the protocol by creating infinite no of streams by giving same sender address as receiver. In some cases a sender can give same receiver address by mistake. In this scenario it doesn't make sense to create a stream like that.

Impact

So a malicious attacker can create many no of streams as sender and receiver as his address and will spam the protocol as there is no finanical loss to the attacker to do so.

Tools Used

Manual Inspection

Recommendations

Add a check in SablierFlow.sol::_create() as sender and receiver shouldn't be same