Submitted by gpersoon, also found by pauliax, WatchPug, cmichel, hyh, and leastwood
Anyone can call the function vest() of Vesting.sol, for example with a smail \_amount of tokens, for any \_beneficiary.
The function overwrites the value of benRevocable\[\_beneficiary], effectively erasing any previous value.
So you can set any \_beneficiary to Revocable.
Although revoke() is only callable by the owner, this is circumventing the entire mechanism of benRevocable.
// https://github.com/code-423n4/2021-11-bootfinance/blob/7c457b2b5ba6b2c887dafdf7428fd577e405d652/vesting/contracts/Vesting.sol#L73-L98
Whitelist the calling of vest()
Or check if values for benRevocable are already set.
chickenpie347 (Boot Finance) confirmed
