Vyper Vested Claims

First Flight #34
Beginner FriendlyDeFi
100 EXP
View results
Submission Details
Severity: medium
Invalid

Inconsistent State on Merkle Root Update (Claimed Amount Mapping Not Reset)

Updates

Lead Judging Commences

bube Lead Judge
29 days ago

Appeal created

bube Lead Judge 28 days ago
Submission Judgement Published
Validated
Assigned finding tags:

`set_merkle_root` doesn't reset the `claimed_amount`

If the contract is reused with another Merkle root and there is a user participated in the previous airdrop, user's claimed amount will not be set to 0. This means if the new total amount is 1000 and the user has claimed amount (from previous aidrop) equals to 500, the user will be able to receive only 500 tokens instead of intended 1000. The `set_merkle_root` is called only by the owner who is trusted. Therefore, we can assume that the owner will not call the function during the existing vesting period or before all users claim their token amounts. The owner can check manually if all users have claimed their tokens.

freesultan Auditor
26 days ago
bube Lead Judge
26 days ago
bube Lead Judge 25 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can’t find an answer? Join our Discord or follow us on Twitter.

Cyfrin
Updraft
CodeHawks
Solodit
Resources