search

code-423n4 / 2021-11-vader-findings

0 stars 0 forks source link

Users Can Reset Bond Depositor's Vesting Period #259

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

leastwood

Vulnerability details

Impact

The VaderBond.deposit() function overwrites a depositors bond info on each call with the updated payout information. If any of the vesting is left unclaimed before a call to deposit() is made, the vesting period is reset to terms.vestingTerm, resulting in the bond holder having to wait again in order to claim tokens that they could previously claim.

Proof of Concept

https://github.com/code-423n4/2021-11-vader/blob/main/repo/vader-bond/contracts/VaderBond.sol#L192

Tools Used

Manual code review.

Recommended Mitigation Steps

Consider preventing users from depositing to an existing bond holder or alternatively when a deposit is made, force the user to redeem any claimable tokens in the same function.

0xstormtrooper commented 3 years ago

Users will be warned that depositing resets the vesting term. This will also be documented on the contract.