Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
abdelstark/token-vesting-contracts
main @ 7776245
5
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Logic Error: 4 prior fixes. Scrutinize any change in this area.
contracts/TokenVesting.sol: most-fixed (4 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Logic Error: Flawed math and state management when revoking a vesting schedule can allow owners to inappropriately reclaim vested tokens or corrupt the tracking of the total vesting schedule pool due to unassigned subtraction results.
Auth Bypass: Failure to grant administrative roles to the contract deployer (msg.sender) during initialization leaves privileged operations exposed or inaccessible, preventing proper management of the vesting schedules.
Logic Error: Using the start time instead of the cliff time in vesting arithmetic can lead to inaccurate vested token calculations, potentially allowing premature or over-allocation of vested tokens.