Core Contracts

Summary

The release() function enforces a minimum release interval (MIN_RELEASE_INTERVAL = 1 day), meaning beneficiaries can only claim tokens once per day. However, if a user attempts to claim tokens right before the vesting duration ends, they may need to wait an extra day beyond the expected vesting period to withdraw their final tokens. This results in an unintended delay in accessing fully vested tokens.

Vulnerability Details

• The _calculateReleasableAmount() function ensures that tokens are released gradually based on time elapsed.

• The function includes this check:

  if (block.timestamp < schedule.lastClaimTime + MIN_RELEASE_INTERVAL) return 0;

  This means that after each claim, the user must wait at least 1 full day before claiming again.

• If a user makes a claim just before the VESTING_DURATION ends, the next claim will only be possible after MIN_RELEASE_INTERVAL (1 day), effectively extending the vesting period beyond the expected duration.

• This delay is not intentional and does not reflect the linear vesting logic expected by beneficiaries.

Impact

Unintended Claiming Delays: A beneficiary expecting full access to their vested tokens at VESTING_DURATION may need to wait an extra day to claim the remaining amount.

Tools Used

Manual Code Review

Recommendations

Protocol should make sure that user dont have to face such delays.