Flow

Summary

The Create function on SablierFlow.sol, doesn’t checks whether the entire streamed amount has been withdrawn from the stream this can lead to the remaining balance becomes locked.

https://github.com/Cyfrin/2024-10-sablier/blob/8a2eac7a916080f2022527408b004578b21c51d0/src/SablierFlow.sol#L564

Vulnerability Details

The function _create, doesn't checks whether the entire streamed amount has been withdrawn from the stream before updating the stream states in the contract.

Since the Sender has the ability to change rps, pause, restart, void and refund from the stream. Sender can also withdraw from the stream as long as the to address is set to the receiver and claim back the un-streamed amount. But streamed balance upto the elapsed time can still be claimed by the receiver.

It is rare to happen but imagine in a scenario where a sender has multiple payments or just a single payment and he or she forgot to claim back even after fully paid the debt the funds maybe locked, we should not assume that the sender is up to his or her task.

Impact

No way to recover the "orphaned" balance

Tools Used

manual

Recommendations

1. Check if there's any remaining balance

2. Ensure all funds are withdrawn or handled

3. Only then allow state updates