VTVL contest - 0x52's results

Lines of code

https://github.com/code-423n4/2022-09-vtvl/blob/f68b7f3e61dad0d873b5b5a1e8126b839afeab5f/contracts/VTVLVesting.sol#L418-L437

Vulnerability details

Impact

Vested but unclaimed tokens are stolen from user

Proof of Concept

When revokeClaim is called, it removes all remaining tokens for a user vested or unvested. Vested tokens should be considered as tokens already paid and shouldn't be revokable, for the protection of the user being paid. Admin is a trusted role but it measures should always be taken with every trusted party to reduce that trust to a minimum.

Tools Used

Manual Review

Recommended Mitigation Steps

revokeClaim should adjust the users claim preserving the currently vested tokens and only remove unvested tokens