Summary:

https://github.com/CodeHawks-Contests/2025-02-vyper-vested-claims/blob/main/src/Token.vy#L24

def _update(_from: address, _to: address, _value: uint256):
self.balanceOf[_from] -= _value # Potential underflow
self.balanceOf[_to] += _value
log IERC20.Transfer(_from, _to, _value)

Bug: There is no check to ensure _from has enough balance before subtracting

Vulnerability Details:

There is no check to ensure _from has enough balance before subtracting and it will Causes an underflow

Impact:

Causes an underflow in Vyper, allowing transfers of more tokens than the _from address owns.

Tools Used: none

Recommendations:

Add a check:

assert self.balanceOf[_from] >= _value, "Insufficient balanc

e"