Submitted by __141345__, also found by 0xDecorativePineapple, CertoraInc, djxploit, hyh, IllIllI, JohnSmith, MiloTruck, rbserver, and zzzitron
VTVLVesting.sol#L295
VTVLVesting.sol#L388
Some ERC20 tokens balance could change, one example is stETH. The balance could become insufficient at the time of withdraw(). Users fund will be locked due to DoS. The way to take the fund out is to send more token into the contract, causing fund loss to the protocol. And there is no guarantee that until the end time the balance would stay above the needed amount, the lock and loss issue persist.
For stETH like tokens, the balanceOf() value might go up or down, even without transfer.
In VTVLVesting, the require check for the spot balanceOf() value will pass, but it is possible that as time goes on, the value become smaller and fail the transfer. As a result, the withdraw() call will revert, causing DoS, and lock users fund.
https://etherscan.io/address/0x312ca0592a39a5fa5c87bb4f1da7b77544a91b87#code
Disallow such kind of variable balance token.
0xean (judge) decreased severity to Medium and commented:
lawrencehui (VTVL) confirmed and commented:
0xean (judge) commented:
