Vyper Vested Claims

Summary

While the rescue functionality is intended as a safeguard for emergencies, it inherently provides significant control over the contract’s funds. This design choice centralizes risk in the hands of the owner.

Vulnerability Details

• Location: rescue_tokens function

• Issue: No additional safeguards (such as multi-signature approval or time delays) are implemented for the owner’s ability to withdraw tokens.

• Risk: A compromised or malicious owner could misuse this function to withdraw tokens prematurely or against the interests of the vesting schedule.

Impact

• Loss of trust among users and potential misallocation of tokens.

• Increased risk of funds being drained from the contract if owner credentials are exposed.

Tools Used

• Code review

• Manual static analysis

Recommendations

• Consider implementing multi-signature controls or time-lock mechanisms to add an extra layer of security for emergency functions.

• Clearly document the rescue function’s intended use and associated risks so that users are aware of the centralized control aspect.