Submitted by 0xc0ffEE, also found by attentioniayn, ChainProof, falconhoof, rouhsamad, sl1, and TheKhans
https://github.com/code-423n4/2024-12-secondswap/blob/214849c3517eb26b31fe194bceae65cb0f52d2c0/contracts/SecondSwap_StepVesting.sol#L216-L235
https://github.com/code-423n4/2024-12-secondswap/blob/214849c3517eb26b31fe194bceae65cb0f52d2c0/contracts/SecondSwap_VestingManager.sol#L139
The token issuer has the ability to change vesting allocation. However, a user can prevent his vesting from being allocated by listing his vesting to the marketplace.
The function SecondSwap_StepVesting::transferVesting() can be used by token issuer to transfer vesting, effectively reallocating vestings. By listing the vesting to marketplace, sellers allocated amount is sent to VestingManager contract, which can make the token issuer unable to reallocate his vesting directly (due to available amount check). Indeed, if the token issuer decides to reallocate that wanted amount from VestingManager, then this can cause the marketplace to be insolvent.
Note that: This attack vector can be done by front-running, since the codebase is deployed to Ethereum.
Impacts:
Add this test below to the file test/VestingManager.test.ts, under describe("List, Purchase and Transfer".
Run the test and it succeeds.
Consider adding trusted role to unlist from marketplace, so that the reallocation can be handled completely.
bobwong (SecondSwap) acknowledged
