search

sherlock-audit / 2024-05-tokensoft-distributor-contracts-update-judging

3 stars 2 forks source link

samuraii77 - Users are unable to claim their tokens #28

Closed sherlock-admin2 closed 5 months ago

sherlock-admin2 commented 5 months ago

samuraii77

high

Users are unable to claim their tokens

Summary

Users are unable to claim their tokens

Vulnerability Detail

Upon claiming using PerAddressContinuousVestingMerkleDistributor or PerAddressTrancheVestingMerkleDistributor, the flow goes through AdvancedDistributor#_executeClaim() which receives the data about how the vesting is supposed to happen.

function _executeClaim(address beneficiary, uint256 totalAmount, bytes memory)
        internal
        virtual
        override
        returns (uint256 _claimed)
    {
        _claimed = super._executeClaim(beneficiary, totalAmount, new bytes(0));
        _reconcileVotingPower(beneficiary);
    }

The issue here is that the data received as the third parameter is completely omitted and instead, bytes(0) is used as the data. That is later decoded into the according type (tranches or cliff, start and end) but that will revert essentially disallowing users from claiming.

Impact

Users are unable to claim their tokens

Code Snippet

https://github.com/sherlock-audit/2024-05-tokensoft-distributor-contracts-update/blob/67edd899612619b0acefdcb0783ef7a8a75caeac/contracts/packages/hardhat/contracts/claim/factory/AdvancedDistributorInitializable.sol#L106-L114

Tool used

Manual Review

Recommendation

Use the data provided instead of omitting it.

Duplicate of #11