Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Vesting Contract's _calculateReleasableAmount Function Issue

01chenqing

Summary

In the _calculateReleasableAmount function, the calculation of the vestedAmount uses integer division, which may lead to scenarios where vestedAmount is calculated as zero. This particularly occurs when the totalAmount is small and the duration is long. As a result, users may be unable to withdraw any assets until the duration is reached, effectively locking their tokens without the ability to release them over time.

Vulnerability Details

Key issues in the _calculateReleasableAmount function. When totalAmount is small relative to duration, the value of vestedAmount can end up being zero due to rounding down, which is the nature of integer division in Solidity.

/**
* @notice Calculates releasable amount for a vesting schedule
* @param schedule The vesting schedule to calculate for
* @return The amount of tokens that can be released
*/
function _calculateReleasableAmount(
VestingSchedule memory schedule
) internal view returns (uint256) {
if (block.timestamp < schedule.startTime + VESTING_CLIFF) return 0;
if (block.timestamp < schedule.lastClaimTime + MIN_RELEASE_INTERVAL) return 0;
uint256 timeFromStart = block.timestamp - schedule.startTime;
if (timeFromStart >= schedule.duration) {
return schedule.totalAmount - schedule.releasedAmount;
}
uint256 vestedAmount = (schedule.totalAmount * timeFromStart) / schedule.duration; // Potentially zero
return vestedAmount - schedule.releasedAmount;
}

Since the function returns vestedAmount - schedule.releasedAmount, if vestedAmount is calculated as zero, then the user cannot release any tokens until the duration is complete, even though some assets may be vested.

Impact

The impact of this vulnerability can lead to user dissatisfaction as they are unable to access their vested tokens.

Tools Used

Manual Code Review

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.