Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing updation of vestingschedule.releaseAmount when creating a new vesting schedule

anonymousjoe

Summary

It is expected that multiple vesting schedule will be created for a benificary. This can be seen in the createVestingSchedule function (uint256 newCategoryTotal = categoryUsed[category] + amount;). Further when a new vesting schedule is made for a benificary, the old vestingSchedule.releasedAmount is not updated to 0. This causes amount released less than expected.

Vulnerability Details

The amount of tokens released is calculated as follows:

function _calculateReleasableAmount(
VestingSchedule memory schedule
) internal view returns (uint256) {
if (block.timestamp < schedule.startTime + VESTING_CLIFF) return 0;
if (block.timestamp < schedule.lastClaimTime + MIN_RELEASE_INTERVAL) return 0;
uint256 timeFromStart = block.timestamp - schedule.startTime;
if (timeFromStart >= schedule.duration) {
return schedule.totalAmount - schedule.releasedAmount;
}
uint256 vestedAmount = (schedule.totalAmount * timeFromStart) / schedule.duration;
return vestedAmount - schedule.releasedAmount;
}

It can be seen that the vestedAmount is subtracted from the releasedAmount , which if the releasedAmount is not updated during the creation of the vesting schedule, will return less than expected values.

Impact

vesting schedule functionality broken

Tools Used

manual review

Recommendations

update the vestingSCedule.releasedAmount = 0 when creating a new vesting schedule.

Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

anonymousjoe Submitter
7 months ago
inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!