Submitted by leastwood, also found by cmichel, hickuphh3, hyh, rfa, and WatchPug
The updateVestedTokens() function is intended to be called by the FSD.sol contract when updating a users vested token amount. A check is performed to ensure that _user == beneficiary, however, as _user is a user controlled argument, it is possible to spoof calls to updateVestedTokens() such that anyone can arbitrarily add any amount to the vested contract. Additionally, there is no check to ensure that the call originated from a trusted/whitelisted source.
There are two main reasons as to why the beneficiary or an attacker would want to call this function:
Manual code review.
Discussions with dev.
Ensure that the updateVestedTokens() function is only callable from the FSD.sol contract. This can be done by implementing an onlyFSD role.
YunChe404 (FairSide) confirmed
