User needs to have a vesting plan

Oct 13, 2025 by talynt.org 46 views

Polished Chambray Sealion - [H-02] - Slippage Vulnerability in Vesting Plan Update Leads to Incorrect Token Deduction

Introduction

The Polished Chambray Sealion is a vulnerability in the vesting plan update mechanism of the SYMM token, which can lead to incorrect token deductions due to slippage in the liquidity pool. This article will delve into the root cause of the issue, internal and external pre-conditions, attack path, impact, and provide a proof-of-concept (PoC) code to demonstrate the vulnerability. Additionally, we will discuss the mitigation steps to resolve this issue.

Summary

The _addLiquidityProcess function in the SymmVesting contract calls _addLiquidity(amount, minLpAmount, maxUsdcIn), which returns amountsIn[0] — the actual amount of SYMM tokens used. Due to slippage, amountsIn[0] may be less than the requested amount. However, the SYMM vesting plan is updated by reducing the locked amount by amountsIn[0]:

symmVestingPlan.resetAmount(symmLockedAmount - amountsIn[0]);

This means that if amountsIn[0] is less than amount, the difference (amount - amountsIn[0]) remains locked in the user’s SYMM vesting plan, even though the user still receives LP tokens based on the liquidity added.

Root Cause

The issue stems from the following line in _addLiquidityProcess:

symmVestingPlan.resetAmount(symmLockedAmount - amountsIn[0]);

This deducts only the slipped amount (amountsIn[0]) from the locked SYMM, rather than the full requested amount (amount), leaving the user with the difference as extra locked SYMM.

Internal Pre-conditions

User needs to have a vesting plan such that vestingPlans[SYMM][user].amount is at least greater than 0.
User needs to call addLiquidity or addLiquidityByPercentage to set the requested amount to be at most equal to symmLockedAmount.
Slippage must occur such that amountsIn[0] will be less than amount.

External Pre-conditions

The liquidity pool needs to experience slippage to set the actual SYMM used (amountsIn[0]) to be less than the requested amount, due to market conditions or pool imbalances.

Attack Path

User calls addLiquidity or addLiquidityByPercentage with a requested amount of SYMM to add liquidity.
Slippage occurs in the liquidity pool, causing _addLiquidity to return amountsIn[0] less than the requested amount.
_addLiquidityProcess updates the vesting plan by deducting only amountsIn[0] from symmLockedAmount.
User receives LP tokens proportional to amountsIn[0] while retaining the difference (amount - amountsIn[0]) as locked SYMM.

Impact

The user gains an approximate excess of amount - amountsIn[0] in locked SYMM tokens, which should have been deducted.
The protocol suffers a disruption in tokenomics as more SYMM remains locked than intended, potentially leading to inflation or unfair advantages.

PoC

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.18;

import "forge-std/Test.sol";

// Simplified VestingPlan library for demonstrating the slippage vulnerability
library VestingPlan {
    struct Plan {
        uint256 amount; // Total locked amount
    }

    // Initialize a vesting plan with a specified amount
    function setup(Plan storage plan, uint256 amount) internal {
        plan.amount = amount;
    }

    // Return the current locked amount (full amount for simplicity)
    function lockedAmount(Plan storage plan) internal view returns (uint256) {
        return plan.amount;
    }

    // Update the locked amount after usage
    function resetAmount(Plan storage plan, uint256 newAmount) internal {
        plan.amount = newAmount;
    }
}

// Wrapper contract to simulate the slippage vulnerability
contract VestingSlippagePoCWrapper is Test {
    address public constant SYMM = address(0x456);    // SYMM token address
    address public constant SYMM_LP = address(0x789); // SYMM LP token address
    address user = address(0x123);                    // Test user address

    mapping(address => mapping(address => VestingPlan.Plan)) public vestingPlans;

    // Set up initial vesting plan with 100 SYMM for the user
    function setUp() public {
        VestingPlan.setup(vestingPlans[SYMM][user], 100 ether);
    }

    // Retrieve the locked amount for a token and user
    function getLockedAmount(address token, address user) public view returns (uint256) {
        return VestingPlan.lockedAmount(vestingPlans[token][user]);
    }

    // Simulate liquidity addition with slippage
    function addLiquidityProcess(uint256 amount, uint256[] memory mockAmountsIn, uint256 mockLpAmount) external {
        uint256 symmLockedAmount = VestingPlan.lockedAmount(vestingPlans[SYMM][msg.sender]);
        require(symmLockedAmount >= amount, "Insufficient SYMM locked");

        // Simulate slippage: use mockAmountsIn[0] (e.g., 80 SYMM) instead of requested amount (100 SYMM)
        uint256 symmUsed = mockAmountsIn[0];
        uint256 lpAmount = mockLpAmount;

        // Update SYMM vesting plan with slipped amount
        VestingPlan.resetAmount(vestingPlans[SYMM][msg.sender], symmLockedAmount - symmUsed);

        // Set up LP vesting plan with received LP tokens
        VestingPlan.setup(vestingPlans[SYMM_LP][msg.sender], lpAmount);
    }
}

// Test contract to verify the slippage vulnerability
contract VestingSlippagePoCTest is Test {
    VestingSlippagePoCWrapper wrapper;

    function setUp() public {
        wrapper = new VestingSlippagePoCWrapper();
        wrapper.setUp();
    }

    function testSlippageVulnerability() public {
        address user = address(0x123);
        uint256 amount = 100 ether; // Requested SYMM amount for liquidity

        // Mock slippage scenario: 80 SYMM used, 50 LP tokens received
        uint256[] memory mockAmountsIn = new uint256[](2);
        mockAmountsIn[0] = 80 ether; // SYMM actually used
        mockAmountsIn[1] = 20 ether; // Placeholder for USDC (not critical for PoC)
        uint256 mockLpAmount = 50 ether; // LP tokens received

        // Step 1: Verify initial SYMM locked amount is 100 ether
        uint256 initialLocked = wrapper.getLockedAmount(wrapper.SYMM(), user);
        assertEq(initialLocked, 100 ether, "Initial SYMM locked should be 100 ether");

        // Step 2: Simulate liquidity addition with slippage as the user
        vm.prank(user);
        wrapper.addLiquidityProcess(amount, mockAmountsIn, mockLpAmount);

        // Step 3: Check updated SYMM locked amount (100 - 80 = 20 ether)
        uint256 updatedSymmLocked = wrapper.getLockedAmount(wrapper.SYMM(), user);
        assertEq(updatedSymmLocked, 20 ether, "SYMM locked should be 20 ether after slippage");

        // Step 4: Verify LP tokens locked (50 ether)
        uint256 lpLocked = wrapper.getLockedAmount(wrapper.SYMM_LP(), user);
        assertEq(lpLocked, 50 ether, "LP locked should be 50 ether");

        // Vulnerability: User retains 20 SYMM locked + 50 LP tokens due to slippage
    }
}

Mitigation

To resolve this issue, modify the vesting plan update to deduct the full requested amount rather than the slipped amount:

- symmVestingPlan.resetAmount(symmLockedAmount - amountsIn[0]);
+ symmVestingPlan.resetAmount(symmLockedAmount - amount);

This change ensures that the user's vesting plan is updated correctly, and the difference between the requested and actual amounts is not retained as locked SYMM.
Polished Chambray Sealion - [H-02] - Slippage Vulnerability in Vesting Plan Update Leads to Incorrect Token Deduction

Q&A

Q: What is the Polished Chambray Sealion vulnerability?

A: The Polished Chambray Sealion is a vulnerability in the vesting plan update mechanism of the SYMM token, which can lead to incorrect token deductions due to slippage in the liquidity pool.

Q: What is slippage in the context of the Polished Chambray Sealion vulnerability?

A: Slippage refers to the difference between the requested amount of SYMM tokens and the actual amount of SYMM tokens used in the liquidity pool. Due to slippage, the actual amount of SYMM tokens used may be less than the requested amount.

Q: How does the Polished Chambray Sealion vulnerability affect the user?

A: The user retains the difference between the requested and actual amounts of SYMM tokens as locked SYMM, even though they still receive LP tokens based on the liquidity added.

Q: What are the internal pre-conditions for the Polished Chambray Sealion vulnerability to occur?

A: The internal pre-conditions for the Polished Chambray Sealion vulnerability to occur are:

The user needs to have a vesting plan such that vestingPlans[SYMM][user].amount is at least greater than 0.
The user needs to call addLiquidity or addLiquidityByPercentage to set the requested amount to be at most equal to symmLockedAmount.
Slippage must occur such that amountsIn[0] will be less than amount.

Q: What are the external pre-conditions for the Polished Chambray Sealion vulnerability to occur?

A: The external pre-conditions for the Polished Chambray Sealion vulnerability to occur are:

The liquidity pool needs to experience slippage to set the actual SYMM used (amountsIn[0]) to be less than the requested amount, due to market conditions or pool imbalances.

Q: What is the impact of the Polished Chambray Sealion vulnerability on the protocol?

A: The protocol suffers a disruption in tokenomics as more SYMM remains locked than intended, potentially leading to inflation or unfair advantages.

Q: How can the Polished Chambray Sealion vulnerability be mitigated?

A: The vulnerability can be mitigated by modifying the vesting plan update to deduct the full requested amount rather than the slipped amount:

- symmVestingPlan.resetAmount(symmLockedAmount - amountsIn[0]);
+ symmVestingPlan.resetAmount(symmLockedAmount - amount);

This change ensures that the user's vesting plan is updated correctly, and the difference between the requested and actual amounts is not retained as locked SYMM.

Q: What is the proof-of-concept (PoC) code for the Polished Chambray Sealion vulnerability?

A: The PoC code is provided in the article and demonstrates the vulnerability by simulating a slippage scenario and verifying the impact on the user's vesting plan.

Q: What are the key takeaways from the Polished Chambray Sealion vulnerability?

A. The Polished Chambray Sealion vulnerability highlights the importance of accurate token deductions in vesting plans. B. Slippage in the liquidity pool can lead to incorrect token deductions and disrupt tokenomics. C. Mitigating the vulnerability requires modifying the vesting plan update to deduct the full requested amount rather than the slipped amount.