Overriding Total and Claimed Values

Oct 13, 2025 by talynt.org 135 views

Winning Currant Koala - resetAmount Function: Unauthorized Vesting Plan Manipulation

Introduction

In the world of blockchain and smart contracts, security is of utmost importance. A single vulnerability can lead to catastrophic consequences, including financial losses and reputational damage. In this article, we will delve into the resetAmount function of the LibVestingPlan contract, which has been identified as a critical vulnerability. We will explore the root cause of the issue, the internal and external pre-conditions that make it possible, and the potential attack paths that an attacker can take to exploit this vulnerability.

Summary

The resetAmount function in the LibVestingPlan contract is designed to reset the amount of tokens that can be claimed by a vesting plan holder. However, due to a lack of proper access controls and input validation, an attacker can arbitrarily modify vesting plans, rebase vesting schedules, set new token totals, and reset claimed amounts. This vulnerability allows an unauthorized actor to extend vesting durations or deny vesting claims, leading to significant financial losses for the affected parties.

Root Cause

The root cause of this vulnerability lies in the design of the resetAmount function. The function does not enforce any authorization checks or validate that the caller is permitted to modify the vesting plan. Instead, it simply rebases the vesting plan from the current time, sets the new total token amount, and resets the claimed amount to zero. This design flaw permits any actor with access to call this function (or via a misused admin function) to override the vesting parameters, regardless of the original agreement with the user.

Internal Pre-conditions

For the resetAmount function to be triggered, the following internal pre-conditions must be met:

Vesting Plan Existence: A vesting plan must be set up with a nonzero amount and defined start and end times.
Claimable State: The plan must have zero claimable tokens (i.e., claimable(self) == 0) for the reset to proceed.
Plan Duration: The remaining duration must be nonzero, otherwise the function reverts.

External Pre-conditions

For an attacker to exploit this vulnerability, the following external pre-conditions must be met:

Actor with Access: An actor with access to call functions that internally invoke resetAmount (e.g., via an administrative or misconfigured contract call) must be able to trigger the reset.

Attack Path

The attack path for exploiting this vulnerability involves the following steps:

Triggering the Reset: An attacker (or a malicious admin) calls the function that internally invokes resetAmount on a target user's vesting plan.
Rebasing the Vesting Plan: The function resets the start time to the current block timestamp and the end time to the current block timestamp plus the remaining duration, effectively rebasing the vesting schedule.
Overriding Total and Claimed Values: The total vesting amount is arbitrarily set to a new amount, and the claimed amount is reset to zero.

Impact

The impact of this vulnerability can be significant, including:

Grief Attack: An attacker can set the start time to a future date, effectively extending the vesting duration.
Loss of Funds: An attacker can set the end time to a far future date, resulting in funds being locked inside the contract. Alternatively, an attacker can set the claimed amount to a large value, preventing users from claiming their tokens.

PoC

Unfortunately, there is no publicly available proof-of-concept (PoC) code for this vulnerability.

Mitigation

To mitigate this vulnerability, the resetAmount function should be marked as internal, making it only available for contracts that inherit it. This will prevent unauthorized actors from calling the function directly and reduce the risk of exploitation.

In conclusion, the resetAmount function in the LibVestingPlan contract is a critical vulnerability that can be exploited by unauthorized actors. The lack of proper access controls and input validation makes it possible for attackers to modify vesting plans, rebase vesting schedules, set new token totals, and reset claimed amounts. By marking the function as internal and implementing additional security measures, the risk of exploitation can be significantly reduced.
Winning Currant Koala - resetAmount Function: Unauthorized Vesting Plan Manipulation

Q&A

In this section, we will address some of the most frequently asked questions related to the resetAmount function vulnerability.

Q: What is the `resetAmount` function, and what is its purpose?

A: The resetAmount function is a part of the LibVestingPlan contract, designed to reset the amount of tokens that can be claimed by a vesting plan holder. Its purpose is to allow administrators to modify vesting plans and reset claimed amounts.

Q: What is the root cause of the `resetAmount` function vulnerability?

A: The root cause of the vulnerability lies in the design of the resetAmount function, which does not enforce any authorization checks or validate that the caller is permitted to modify the vesting plan.

Q: What are the internal pre-conditions for the `resetAmount` function to be triggered?

A: The internal pre-conditions for the resetAmount function to be triggered are:

Vesting Plan Existence: A vesting plan must be set up with a nonzero amount and defined start and end times.
Claimable State: The plan must have zero claimable tokens (i.e., claimable(self) == 0) for the reset to proceed.
Plan Duration: The remaining duration must be nonzero, otherwise the function reverts.

Q: What are the external pre-conditions for an attacker to exploit this vulnerability?

A: The external pre-conditions for an attacker to exploit this vulnerability are:

Actor with Access: An actor with access to call functions that internally invoke resetAmount (e.g., via an administrative or misconfigured contract call) must be able to trigger the reset.

Q: What are the potential attack paths for exploiting this vulnerability?

A: The potential attack paths for exploiting this vulnerability involve:

Triggering the Reset: An attacker (or a malicious admin) calls the function that internally invokes resetAmount on a target user's vesting plan.
Rebasing the Vesting Plan: The function resets the start time to the current block timestamp and the end time to the current block timestamp plus the remaining duration, effectively rebasing the vesting schedule.
Overriding Total and Claimed Values: The total vesting amount is arbitrarily set to a new amount, and the claimed amount is reset to zero.

Q: What are the potential impacts of this vulnerability?

A: The potential impacts of this vulnerability include:

Grief Attack: An attacker can set the start time to a future date, effectively extending the vesting duration.
Loss of Funds: An attacker can set the end time to a far future date, resulting in funds being locked inside the contract. Alternatively, an attacker can set the claimed amount to a large value, preventing users from claiming their tokens.

Q: How can the vulnerability be mitigated?

A: The vulnerability can be mitigated by marking the resetAmount function as internal, making it only available for contracts that inherit it. This will prevent unauthorized actors from calling the function directly and reduce the risk of exploitation.

Q: Is there a proof-of-concept (PoC) code available for this vulnerability?

A: Unfortunately, there is no publicly available proof-of-concept (PoC) code for this vulnerability.

Q: What should developers do to prevent similar vulnerabilities in the future?

A: Developers should ensure that all functions, especially those that modify critical data or perform sensitive operations, are properly secured with authorization checks and input validation. Additionally, they should follow best practices for smart contract development, such as using secure coding guidelines and conducting thorough security audits.