Vesting benRevocable flag can be switched on and off by anyone and doesn't provide any additional control

Handle hyh Vulnerability details Impact Griefing attack is possible for revoke mechanics by calling vest with a tiny amount and zero isRevocable. This will switch revocable off for the whole vesting amount i.e. the whole set of timelocks flag is being set via last vest call. And vice versa,...

Overwrite benRevocable

Handle gpersoon Vulnerability details Impact Anyone can call the function vest of Vesting.sol, for example with a smail "amount" of tokens, for any beneficiary. The function overwrites the value of benRevocablebeneficiary, effectively erasing any previous value. So you can set any beneficiary to...