code-423n4 / 2021-05-nftx-findings

1 stars 0 forks source link

Can lock more tokens than in contract #121

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

Vulnerability Details

The Visor.timeLockERC20 allows locking any amount of tokens exceeding the contract's token balance.

Impact

The recipient might think that they'll receive the tokens after expiry but it could be that the contract is already out of tokens by then.

Recommended Mitigation Steps

Make sure that the contract has enough tokens to cover all locks at all times.