getBalanceLocked on line 202 of Visor.sol doesn't return the total balance, just the highest balance

Handle Sherlock Vulnerability details Impact Causes some internal miscalculations allowing people to take out locked funds using timeUnlockERC20 and delegatedTransferERC20 Proof of Concept Tools Used Hardhat Recommended Mitigation Steps Calculate balance using balance.add lockData.balance on line...

timeUnlockERC20() on line 619 of Visor.sol, able to unlock locked erc20 tokens

Handle Sherlock Vulnerability details Impact Because of getBalanceLocked not returning the full sum of the balances, you can unlock tokens that are locked. Even if the amount balanceaddressthis. You can just transfer tokens to the contract. With a flashloan like structure. Proof of Concept...