# Users can prevent being reallocated by listing to marketplace

Vesting seller lists allocation to marketplace, moving tokens to VestingManager so issuer's transferVesting reallocation reverts on insufficient balance.

- Payout: Contest reward
- Severity: medium
- Program: SecondSwap
- Credited: 0xc0ffEE
- Disclosed: 2025-02-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-secondswap#m-09
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-09
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** SecondSwap_StepVesting / SecondSwap_VestingManager vesting contracts
**Root cause:** transferVesting checks totalAmount - amountClaimed against _amount but does not account for amounts already moved to VestingManager via listVesting, so a listed allocation makes the grantor's remaining balance insufficient for reallocation.
**Steps:**
1. Alice holds 1000 vesting; issuer intends to reallocate 1000 from Alice to Bob via `transferVesting(alice, bob, 1000)`.
2. Alice front-runs by calling marketplace `listVesting(alice, vesting, 200)`, which invokes `SecondSwap_Vesting(plan).transferVesting(alice, address(this), 200)`, reducing Alice's totalAmount to 800.
3. Issuer's `transferVesting(alice, bob, 1000)` now fails the `totalAmount - amountClaimed >= _amount` check, reverting with `SS_StepVesting: insufficient balance`.
4. Reallocating from VestingManager instead would drain marketplace escrow and render it insolvent.
**How found:** Code review of transferVesting's balance check against listVesting's escrow transfer; noticed claimed/listed amounts aren't reconciled, enabling front-run griefing.
**Exploitation:** Seller front-runs the issuer's reallocation transaction on Ethereum by listing a portion of vesting to the marketplace, escrowing it in VestingManager and blocking the issuer's transferVesting call.
**Insight:** When an admin reallocation function checks only totalAmount minus claimed, look for other paths (marketplace escrow, staking) that move the same balance out and can be triggered by the user to grief the admin call via front-running.