Service
Vesting Contracts — Token Vesting Attack Vectors — Security Patterns for Production Vesting Contracts
Vesting contracts hold millions in team and investor tokens. A vesting vulnerability is catastrophic — early release dumps the market, destroys confidence, and may constitute a legal breach of investor agreements. Here are the documented attack classes and defenses. The vulnerability: Using block.timestamp for cliff en...
The vulnerability: Solidity integer division truncates (rounds down). Accumulated rounding errors over many release cycles can cause a beneficiary to receive slightly less than entitled. The dangerous pattern: solidity // POTENTIALLY INACCURATE for small amounts or many cycles function vestedAmount() internal view retu...
The vulnerability: If the vesting contract sends ETH (not ERC-20 tokens), the call{value: amount}("") can re-enter the release function before released is updated. The dangerous pattern: solidity function release() external { uint256 amount = releasable(); // WRONG: External call before state update (bool success, ) =...
The vulnerability: The revoke() function should only be callable by the owner (typically a Gnosis Safe multi-sig). If accessible to the beneficiary or any address, they can front-run a revocation and extract all remaining tokens. The correct pattern: solidity function revoke(bytes32 scheduleId) external onlyOwner { //...
The vulnerability: If scheduleId is computed from parameters that an attacker can control (e.g., a simple counter they can predict), they could potentially overwrite an existing schedule. The correct pattern: solidity // Use a combination that includes owner-controlled entropy scheduleId = keccak256(abi.encodePacked( b...
- [ ] CEI pattern enforced in all release functions - [ ] nonReentrant modifier on release and revoke - [ ] onlyOwner (or equivalent) on revoke - [ ] Cliff uses block.timestamp, not block.number - [ ] Final release releases exact remainder (not calculated amount) - [ ] Schedule IDs use entropy the attacker cannot contr...
Common integrations: The Graph, Alchemy/Infura, OpenZeppelin Defender, and popular wallet providers.
Clarify requirements, compliance needs, architecture risks, and launch goals.
Implement core contracts, integrations, product flows, tests, and deployment automation.
Run QA, prepare audit handoff, deploy infrastructure, and support production rollout.
Revocable for active team members (allows reclamation if someone leaves before cliff). Irrevocable for departed team members who have passed their cliff (they have earned those tokens through their contribution period). This matches standard equity practice: unvested shares clawed back on departure, vested shares remain.
Schedule a discovery call and receive a tailored scope and estimate. No commitment required.