Lines of code

Vulnerability details

Impact

Some tokens take a transfer fee (e.g. STA, PAXG). Tokens like these will be supported because the vested amount will be the amount that was actually transferred (i.e. the balance of the contract after the transfer), but it will cause the user to receive less than the amount he was supposed to receive.

Proof of Concept

Let’s assume the VTVLVesting contract is deployed with the STA token, which takes a 1% transfer fee.

1. The admin transfers 101.01 STA ( = 100 / 0.99, so after the transferred amount will be 100 STA) to the contract so it’s balance after the transfer is 100 STA.
2. The admin creates a claim for Alice using 100 STA.
3. The linear vesting end timestamp is over and Alice calls the claim function, but she receives only 1% of it, which is 99 STA. This is the amount she was supposed to get after 99% of her linear vesting time has passed.

Tools Used

Manual audit

Recommended Mitigation Steps

Consider support fee on transfer tokens in a special way that allows transfer of more tokens to match the amount, or write it down so users will know to pre-calculate the amounts from the beginning

The text was updated successfully, but these errors were encountered:

All reactions