Change the sender of a Lockup stream

[PaulRBerg]

Requested by a user recently:

IIRC:

1. We have received episodic requests for this feature over the years. Right, @maxdesalle?
2. Hedgey offers this feature already.

RFC @sablier-labs/everybody

[maxdesalle]

Correct! This could be under the form of a new sender NFT, that would carry the right to cancel a stream (assuming it's cancelable).

[smol-ninja]

Sounds good. Just one point to add, instead of a simple transferAdmin function, we can consider implementing it as a two-step transfer to mitigate the risk of accidental transfer to an incorrectly copied address. It was also mentioned in our Cantina audit (3.3.1).

[smol-ninja]

I am talking about the stream sender. IIUC, the requirement is to allow a stream sender to update the stream's sender address, right?

[PaulRBerg]

Yes. But above, you said transferAdmin. I thought you thought this was about transferring the admin.

Anyway. I don't think a two-step process would be helpful here. Like, transferring the recipient is a one-step process, which is arguably more dangerous than transferring the sender (i.e. the ability to cancel).

[smol-ninja]

transferring the recipient is a one-step process, which is arguably more dangerous than transferring the sender

Yeah good point.

[andreivladbrg]

transferring the sender (i.e. the ability to cancel).

that's a matter of what's the elapsed time in the stream. if the stream just started and it is cancelable, basically, the sender still owns more of that stream.

re. the proposal, i think we can do it. there isn't anything atm that comes to mind that would cause security issues.

[PaulRBerg]

that's a matter of what's the elapsed time in the stream

Yeah, good point that it depends.

[maxdesalle]

Was just on an unscheduled call with the Fjord team as they have a compromised sender wallet, and are trying to see how they could mass-renounce the streams. Could have been much easier if they could have transferred ownership on the sender side of the streams to another wallet. Batch stream transfers would require Account Abstraction, though, so this is probably not immediately urgent.

[PaulRBerg]

As discussed on Slack, a sender transfer feature would have been helpful only if they could batch transfer streams.

Also, in the case where the attacker had been aware of the streams, the transfer feature wouldn't have achieved much.

A more immediate problem is the lack of renounceMultiple. Will open a separate discussion about this.

[PaulRBerg]

One more (implicit) request for this feature.

[PaulRBerg]

Request from Ondefy: