Core Contracts

Summary

amount released by revoked vesting schedules can't be reused to create new vesting schedules

Vulnerability Details

When creat vesting schedules, categoryUsed[category] is updated, according to input amount. However, when the schedule is revoked, tokens are transferred back, but categoryUsed[category] is not updated. As a result, the amount release by revoked vesting schedule can't be reused to create new vesting schedules. Please refer to the following steps:

1, categoryAllocations[categoryA] = 100.

2, create 10 vesting schedules, each with amount 10, then categoryUsed[categoryA] = 100.

3, after a while, EMERGENCY_ROLE revoke those 10 schedules, total unreleasedAmount is 90.

4, try to create a new vesting schedule with amount 10, will revert, since categoryUsed[categoryA]=100, categoryAllocations[categoryA] = 100, categoryUsed[categoryA] + amount > categoryAllocations[categoryA], categoryUsed for categoryA is 10 infact.

Impact

although there are enough tokens, new vesting schedules could not be created.

Tools Used

manually reviewed

Recommendations

update categoryUsed[category] in function emergencyRevoke(), since category is not recorded, we could add element 'bytes32 category' in struct VestingSchedule, and record category when create vesting schedule.