# Underflow in claimable DOSing claim Function

Rounding makes stepsClaimed exceed numOfSteps in SecondSwap StepVesting, so currentStep - stepsClaimed underflows and claim() reverts, locking newly purchased tokens.

- Payout: Contest reward
- Severity: medium
- Program: SecondSwap
- Credited: BugPull
- Disclosed: 2025-02-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-secondswap#m-06
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** SecondSwap_StepVesting.sol vesting claim logic
**Root cause:** stepDuration = (endTime-startTime)/numOfSteps truncates, so currentStep can exceed numOfSteps; claim() pushes stepsClaimed above numOfSteps, and claimable() computes currentStep - stepsClaimed which underflows once a user buys more tokens.
**Steps:**
1. Set _endTime-_startTime=1000, numOfSteps=110, stepDuration=9.
2. User claims at end: currentStep=1000/9=111, claimableSteps=111-100=11, stepsClaimed becomes 111 > numOfSteps=110.
3. User purchases additional tokens (create check fixed to numOfSteps > stepsClaimed).
4. Call claim(): claimable() computes `currentStep - vesting.stepsClaimed` = 111-111 or less, underflowing and reverting.
**How found:** Traced claim()/claimable() arithmetic and noticed stepDuration truncation lets currentStep exceed numOfSteps, then reasoned about a post-claim repurchase path.
**Exploitation:** No attacker profit; a legitimate buyer of additional vesting tokens is permanently unable to claim them because claimable() reverts, leaving funds stuck.
**Insight:** When step counts are derived by integer division of a duration, the final currentStep can exceed numOfSteps; check subtraction operands in view functions that gate state-changing claims, especially after balances/allocations can grow post-claim.