AMOW - Overwriting amount in `updateDepositBalance`

[sherlock-admin4]

AMOW

high

Overwriting amount in updateDepositBalance

Summary

User amount should be incremented instead of overwritten

Vulnerability Detail

When userBalances are updated in Vesting.updateUserDeposit, the function overwrites _amount instead of incrementing/decrementing. This would allow doublespending in case the user spends their entire balance just before updating.

Impact

Loss of funds

Code Snippet

    userdetails[_users[i]].userDeposit = _amount[i];
    amount += _amount[i];

Tool used

Manual Review

Recommendation

Increment/Decrement instead of directly assigning _amount

Duplicate of #55

[spacegliderrrr]

Escalate

(on behalf of watson) should be a dup of #55

[sherlock-admin2]

Escalate

(on behalf of watson) should be a dup of #55

You've created a valid escalation!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[Hash01011122]

Agreed this is indeed duplicate of issue #55

[Evert0x]

Planning to accept escalation, as issue was valid during creation of escalation. However it will stay invalid as the main issue will be invalid

[Evert0x]

Result: Invalid Duplicate of #55

[sherlock-admin3]

Escalations have been resolved successfully!

Escalation status:

• spacegliderrrr: accepted