Vyper Vested Claims
First Flight #34
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Validation for Vesting Time Parameters During Deployment

teoslaf

Summary

The VestedAirdrop contract lacks validation to ensure that vesting_start_time is less than vesting_end_time during contract deployment, which could lead to a permanently broken vesting schedule.

Vulnerability Details

In the contract's constructor, the vesting start and end times are set without any validation:

@deploy
def __init__(merkle_root: bytes32, token: address, vesting_start_time: uint256, vesting_end_time: uint256):
self.merkle_root = merkle_root
self.token = token
self.vesting_start_time = vesting_start_time
self.vesting_end_time = vesting_end_time
self.owner = msg.sender
log MerkleRootUpdated(merkle_root)

If vesting_start_time >= vesting_end_time, the vesting calculation in _calculate_vested_amount() will be broken due to division by zero or incorrect vesting duration calculations:

vesting_duration: uint256 = end_time - start_time # This could be 0 or underflow
elapsed: uint256 = current_time - start_time
vested = instant_release + (linear_vesting * elapsed) // vesting_duration # Division by zero if duration is 0

Impact

If deployed with vesting_start_time >= vesting_end_time:

  1. Division by zero errors would occur in the vesting calculations

  2. Users would be unable to claim their tokens

  3. The entire contract would be permanently broken

  4. A new contract deployment would be required, causing confusion and potential loss of trust

This is a medium severity issue as it doesn't directly lead to fund loss but could render the contract unusable.

Tools Used

Manual code review

Recommendations

Add validation in the constructor to ensure that vesting_start_time is strictly less than vesting_end_time:

@deploy
def __init__(merkle_root: bytes32, token: address, vesting_start_time: uint256, vesting_end_time: uint256):
assert vesting_start_time < vesting_end_time, "Invalid vesting period"
self.merkle_root = merkle_root
self.token = token
self.vesting_start_time = vesting_start_time
self.vesting_end_time = vesting_end_time
self.owner = msg.sender
log MerkleRootUpdated(merkle_root)

This simple check prevents deployment with invalid vesting parameters, ensuring the contract will function as intended.

Updates

Appeal created

bube Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.