Detailed description of the impact of this finding.
the function below config a list of addresses that are eligile to claim the linear vested or cliff vested token
in VTVLVesting.sol contract
for (uint256 i = 0; i < length; i++) {
_createClaimUnchecked(_recipients[i], _startTimestamps[i], _endTimestamps[i], _cliffReleaseTimestamps[i], _releaseIntervalsSecs[i], _linearVestAmounts[i], _cliffAmounts[i]);
}
but practically speaking, the admin may need to set a lot of addresses that are claimable to claim the tokens.
the unbound gas consumption can be expensive for admin.
Proof of Concept
Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
A project need to set 1000 address to claim the vested token. the massive for loop revert because of gas issue. the admin has to pay expensive gas to complete the transactions.
Tools Used
Foundry
Hardhat
Manual Review
Recommended Mitigation Steps
We recommand the project to create a merkle tree root offline and verify the msg.sender of the claimer as the merkle leaf.
combining with whitelist or blacklist, the admin can still control who can claim the token on chain.
Lines of code
https://github.com/code-423n4/2022-09-vtvl/blob/f68b7f3e61dad0d873b5b5a1e8126b839afeab5f/contracts/VTVLVesting.sol#L354
Vulnerability details
Impact
Detailed description of the impact of this finding.
the function below config a list of addresses that are eligile to claim the linear vested or cliff vested token
in VTVLVesting.sol contract
but practically speaking, the admin may need to set a lot of addresses that are claimable to claim the tokens.
the unbound gas consumption can be expensive for admin.
Proof of Concept
Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
A project need to set 1000 address to claim the vested token. the massive for loop revert because of gas issue. the admin has to pay expensive gas to complete the transactions.
Tools Used
Foundry
Hardhat
Manual Review
Recommended Mitigation Steps
We recommand the project to create a merkle tree root offline and verify the msg.sender of the claimer as the merkle leaf.
combining with whitelist or blacklist, the admin can still control who can claim the token on chain.
below are the implementation.
https://github.com/Anish-Agnihotri/merkle-airdrop-starter/blob/master/contracts/src/MerkleClaimERC20.sol
to generate a merkle root based on the token claim configuration, please refer to
https://github.com/Anish-Agnihotri/merkle-airdrop-starter/tree/master/generator
give the configuration below
a merkle root can be generated.