# Unrestricted vestFor

Unrestricted vestFor lets anyone lock any user's Vader for 365 days with a tiny amount, blocking legitimate conversions.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: pauliax
- Disclosed: 2022-02-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/229
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-27
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Vader vesting contract function vestFor
**Root cause:** vestFor has no access control and overwrites/locks a user's vesting entry for 365 days without allowing updates, so any caller can grief any user.
**Steps:**
1. Identify vestFor function callable by anyone with no auth checks.
2. Front-run a legitimate vestFor call by calling `vestFor(victim, tinyAmount)` with an insignificant Vader amount.
3. Victim's vesting is locked for 365 days and cannot be updated, blocking legit conversions.
**How found:** Code review of vestFor noting absence of auth checks and the 365-day lock with no update path, enabling front-running griefing.
**Exploitation:** Attacker front-runs a victim's legitimate vestFor transaction with a minimal-amount vestFor call for the victim, locking the victim's vesting for 365 days and preventing the intended conversion.
**Insight:** Look for permissionless functions that write user-scoped state with long lock periods and no update/overwrite guard; these enable cheap front-run griefing even without direct fund theft.