Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

CreateVestingSchedule::RAACReleaseOrchestrator Allows Past Start Time, Potentially Enabling Instant Token Access

ok567

Finding Description and Impact

The function createVestingSchedule() does not validate that startTime should be >= block.timestamp . This could allow an authorized orchestrator to set a vesting schedule with a startTime in the past. Since the _calculateReleasableAmount() function checks the elapsed time from startTime, this could result in immediate vesting of a large portion of tokens.

Proof of Concept

Code Reference:

  • createVestingSchedule() does not validate startTime:

function createVestingSchedule(
address beneficiary,
bytes32 category,
uint256 amount,
uint256 startTime // @audit no check to see that this should be >=block.timestamp
) external onlyRole(ORCHESTRATOR_ROLE) whenNotPaused {
if (beneficiary == address(0)) revert InvalidAddress();
if (amount == 0) revert InvalidAmount();
if (vestingSchedules[beneficiary].initialized) revert VestingAlreadyInitialized();
if (categoryAllocations[category] == 0) revert InvalidCategory();
// Check category allocation limits
uint256 newCategoryTotal = categoryUsed[category] + amount;
if (newCategoryTotal > categoryAllocations[category]) revert CategoryAllocationExceeded();
categoryUsed[category] = newCategoryTotal;
VestingSchedule storage schedule = vestingSchedules[beneficiary];
schedule.totalAmount = amount;
schedule.startTime = startTime;
schedule.duration = VESTING_DURATION;
schedule.initialized = true;
emit VestingScheduleCreated(beneficiary, category, amount, startTime);
}

Potential Exploit Scenario:

  1. The orchestrator creates a vesting schedule with startTime set 700+ days in the past.

  2. The release() function is called, and _calculateReleasableAmount() allows full token release immediately.

  3. The orchestrator drains the vesting allocation without the expected gradual vesting.

Recommended Mitigation Steps

Add a validation check to ensure startTime is not in the past:

require(startTime >= block.timestamp, "Start time cannot be in the past");
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.