Submitted by sl1, also found by 056Security, 056Security, 0xEkko, 0xrex, agadzhalov, codertjay, Drynooo, Fon, gesha17, IzuMan, ka14ar, KiteWeb3, macart224, montecristo, NexusAudits, NexusAudits, oualidpro, pulse, rouhsamad, TheKhans, Viquetour, yuza101, and Z3R0
https://github.com/code-423n4/2024-12-secondswap/blob/214849c3517eb26b31fe194bceae65cb0f52d2c0/contracts/SecondSwap_StepVesting.sol#L133
When deploying a vesting plan, token issuer can specify the end time of the schedule and number of steps over which tokens should be released. StepVesting calculates the duration of each distinctive step by dividing the duration of the schedule by number of steps.
SecondSwap_StepVesting.sol#L131-L133
However, currently its possible for calculations to round down, which could lead to multiple problems.
First, consider a scenario where calculations of stepDuration round down to 0. This will result in inability to claim funds from the StepVesting contract. In order to claim tokens from the vesting schedule, a user must call claim() function of the contract, which in turn will call claimable() to get the amount of tokens currently available for claim.
SecondSwap_StepVesting.sol#L193-L194
When claimable() is invoked, it will try to calculate current step by dividing elapsed time by duration of the step, which will revert as solidity does not support division by 0.
SecondSwap_StepVesting.sol#L173
Secondly, because of the rounding, its possible that vesting will be completed earlier than the schedule. Consider a 3 month vesting plan which equals 7884000 seconds and the number of steps is 1000000. The step duration will be calculated as 7884000 / 1000000 = 7.884, which will round down to 7. Now the actual time it will take to complete the schedule is 7 * 1000000 = 7000000 seconds, which is 81 days, meaning that vesting is completed roughly 10 days earlier than the schedule.
DoS of the claim() function of the StepVesting contract and premature ending of the vesting schedule.
To set up the following PoC in foundry please follow the steps.
Inside the hardhat project directory:
Run it withforge test --match-test 'test_sl1VestingCompletedEarlier' -vv.
When calculating stepDuration revert when _endTime - _startTime is not perfectly divisible by _numOfSteps.
sl1 (warden) commented:
Koolex (judge) commented:
sl1 (warden) commented:
0xrex (warden) commented:
Koolex (judge) commented:
