Who can toggle an NFT transfer?

[gabrielstoica]

Hey,

I'm looking for a way to withdraw a stream and transfer it to another recipient in a programmatic way, through an intermediary contract (aka Stream Management contract - see this discussion).
As stated in this discussion on NFT transferability, only the stream recipient can toggle the transfer - through the withdrawMaxAndTransfer method which checks if the msg.sender is the current recipient.

However, this can be bypassed through a 3-step process, as follows:

1. Approve the intermediary contract to transfer the stream's NFT by calling the SablierV2Lockup.approve method;
2. Withdraw the maximum withdrawable amount from the stream by calling the withdrawMax method;
3. Transfer the NFT by calling the transferFrom exposed by the SablierV2Lockup implementation;

With all that said, should only the stream recipient be able to transfer the NFT? If so, the workflow above should not be allowed. Otherwise, if that's not an issue, is there another way to accomplish it?

Thanks!

[PaulRBerg]

Hi Gabriel, thanks for your question.

If the user approves an operator through the ERC-721 approve method, then it is a perfectly legitimate behavior for the operator to be able to (i) withdraw the maximum withdrawable amount from the stream and (ii) transfer the NFT.

This makes me think that maybe we should rewrite the check here to call _isCallerStreamRecipientOrApproved instead of checking just the recipient.

cc @sablier-labs/solidity

is there another way to accomplish it?

No, at the moment, you would have to call the two functions separately. But, as I've said, it should be fine to modify the code to allow this behavior to be enacted through the withdrawMaxAndTransfer function directly. I have created a GitHub issue for this.

Thanks for your feedback!

[gabrielstoica]

Hi Paul,

Thanks for your prompt answer. That make sense!

This makes me think that maybe we should rewrite the check here to call _isCallerStreamRecipientOrApproved instead of checking just the recipient.

That's what I was going to ask & propose next.

Thanks again!

[PaulRBerg]

I thank you!