Summary

Going through the onTokenTransfer function with lockId = 0 (for new lock) and non-zero lockingDuration, will always revert with InvalidLockingDuration

Vulnerability Details

This revert is due to the check here if ((_lock.expiry == 0 || _lock.expiry > block.timestamp) && _lockingDuration < _lock.duration) { revert InvalidLockingDuration(); }

A new lock created has all zeros for int/uint, so expiry is zero, true && true

Impact

User might not be allowed to create new vaults through callback

Tools Used

Manaual review

Recommendations