# Tokens that have already been vested can be transferred from a user.

SecondSwap StepVesting transferVesting only checks unclaimed balance, letting issuer move already-vested-but-unclaimed tokens from a beneficiary to another user.

- Payout: Contest reward
- Severity: medium
- Program: SecondSwap
- Credited: sl1
- Disclosed: 2025-02-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-secondswap#m-10
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SecondSwap_StepVesting.transferVesting (Solidity vesting contract)
**Root cause:** transferVesting checks totalAmount - amountClaimed >= _amount, which ignores tokens already vested but not yet claimed; vested tokens are effectively owned by the beneficiary yet still counted as transferable.
**Steps:**
1. Deploy vesting for alice: 10000e18 over 10000 steps
2. Warp forward 5000 seconds so 5000e18 is vested but unclaimed
3. Admin calls `transferVesting(alice, bob, 5000e18, stepVesting, "1")`
4. Alice calls `claim()` and receives only 2500e18 instead of 5000e18
**How found:** Reading transferVesting's balance check and noticing it compares against totalAmount minus amountClaimed, which does not subtract already-vested (released) but unclaimed tokens; confirmed with a Foundry PoC comparing claim before/after transfer.
**Exploitation:** Token issuer/grantor calls transferVesting for an amount equal to the beneficiary's vested-but-unclaimed tokens; the check passes because amountClaimed is still zero, and the beneficiary's claimable balance is reduced, redirecting their vested tokens to another address.
**Insight:** When auditing vesting/streaming contracts, check whether 'remaining' balance math subtracts only claimed amounts rather than vested-and-released amounts; vested-but-unclaimed tokens are user-owned and must be excluded from any issuer reallocation check.