Flow

Description

location : src/SablierFlow.sol

The void function allows either the sender, the recipient, or an approved third party to void a stream. However, the actual access control in the _void internal function only checks if msg.sender is either the stream's sender or an approved third party. It allows any approved address to void the stream.

code :

The _isCallerStreamRecipientOrApproved function determines whether the caller is the recipient or an approved address.

There is a potential issue where an approved address (approved for transfer of the NFT token) can void the stream, which might not be intended.

Impact

An approved operator could void a stream without the consent of the sender or recipient, potentially disrupting the payment stream and causing financial loss.

Recommendation

• Restrict Access to Void Function: Adjust the access control to ensure only the sender or the recipient can void the stream, unless deliberately intended to allow any approved operator to do so.

If the intended behavior is that only the sender or recipient can void the stream, change the access control check to:

If approved operators should have this ability, document this behavior thoroughly to ensure users are aware.