Summary

in the depositAndPause function the notVoided is not used, and while this looks like it still gives the same result, sender can update rps with the adjustRatePerSecond function to unpause and bypass the voided features

Vulnerability Details

In this function depositAndPause at https://github.com/Cyfrin/2024-10-sablier/blob/main/src/SablierFlow.sol#L275

The notVoided is not applied, which allows a user to deposit and then pause, causing streaming to stop to recipient, sender can then restart streaming with the adjustRatePerSecond which do not also have the notVoided modifier as seen at https://github.com/Cyfrin/2024-10-sablier/blob/main/src/SablierFlow.sol#L189
depositAndPause --> adjustRatePerSecond --> Streaming

This flow circumvent the void feature of stopping deposits

Impact

Sender can keep streaming voided stream to recipient even if recipient voided stream

Tools Used

Manual Review

Recommendations

add notVoided to the adjustRatePerSecond and depositAndPause