# In transferVesting, the grantorVesting.releaseRate is calculated incorrectly, which leads to the sender being able to unlock more tokens than were initially locked.

SecondSwap transferVesting recomputes releaseRate from totalAmount ignoring already-claimed tokens, letting a seller re-claim tokens after listing their vesting.

- Payout: Contest reward
- Severity: high
- Program: SecondSwap
- Credited: TheSchnilch
- Disclosed: 2025-02-18
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-12-secondswap#h-03
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SecondSwap_StepVesting.transferVesting (Solidity vesting contract)
**Root cause:** On transferVesting, releaseRate is set to totalAmount/numOfSteps without subtracting amountClaimed or stepsClaimed, so the seller's remaining rate still pays out tokens already claimed.
**Steps:**
1. Deploy StepVesting for token0, 1000 tokens over 10 days, 10 steps.
2. Admin lists 100 tokens via marketplace.listVesting; Alice spotPurchase acquires the 100-token vesting.
3. Warp 5 days; Alice calls vesting.claim() receiving 50 tokens.
4. Alice lists her remaining 50 tokens via listVesting, triggering transferVesting which recomputes releaseRate = totalAmount/numOfSteps ignoring her 50 already claimed.
5. Warp 4 days; Alice calls vesting.claim() again and receives ~20 extra tokens she no longer owns.
6. Bob buys the 50-token listing and claims his share; vesting contract balance shows 880 instead of 900, proving 20 tokens stolen.
**How found:** Code review of transferVesting's releaseRate recalculation, noticing it omits amountClaimed/stepsClaimed unlike the claimable logic.
**Exploitation:** Seller claims part of vesting, then lists the remainder on the marketplace; transferVesting recomputes releaseRate from full totalAmount, so seller keeps claiming during remaining lock period before selling, draining tokens owed to the buyer and other vesting participants.
**Escalation:** Repeated list/claim cycles before lock period ends amplify theft; also violates maxSellPercent invariant.
**Insight:** When a vesting position is split or transferred, recompute the rate from remaining (totalAmount - amountClaimed) over remaining steps; any rate derived from gross totals after partial claims is exploitable by re-claiming.