Submitted by nathaniel, also found by WatchPug, leastwood, and pauliax
The timelocks for any beneficiary are unbounded, and can be vested by someone who is not the beneficiary. When the array becomes significantly big enough, the vestments will no longer be claimable for the beneficiary.
The vest() function in Vesting.sol does not check the beneficiary, hence anyone can vest for anyone else, pushing a new timelock to the timelocks[_beneficiary].
The _claimableAmount() function (used by claim() function), then loops through the timelocks[_beneficiary] to determine the amount to be claimed.
A malicious actor can easy repeatedly call the vest() function with minute amounts to make the array large enough, such that when it comes to claiming, it will exceed the gas limit and revert, rendering the vestment for the beneficiary unclaimable.
The malicious actor could do this to each beneficiary, locking up all the vestments.
Manual code review
chickenpie347 (Boot Finance) confirmed
