Submitted by GiveMeTestEther, also found by ScopeLift
arbitraryCall()s (L733) use case is to claim airdrops by gov. If the address who is a token that could be send as an incentive by an attacker via createIncentive() then such claim can be made unusable, because on L735 there is a require(incentives\[who] == 0, "inc"); that reverts if a who token was received as an incentive.
In this case the the incentives\[who] can be set to 0 by the stream creator by calling claimIncentive() but only after the stream has ended according to require(block.timestamp >= endStream, "stream"); (L520)
If the airdrop is only claimable before the end of the stream, then the airdrop can never be claimed.
If gov is not the stream creator then the stream creator must become also the gov because claimIncentive() only can be called by the stream creator and the arbitraryCall() only by gov. If resetting incentives\[who] to 0 by calling claimIncentive() and arbitraryCall() for the who address doesnt happen atomic, an attacker can send between those two calls again a who token.
brockelmore (Streaming Protocol) acknowledged:
