# Unauthorized increase of maxSellPercent

setSellable re-initializes maxSellPercent to 20% when it is 0, letting users sell tokens the issuer intended to lock.

- Payout: Contest reward
- Severity: medium
- Program: SecondSwap
- Credited: BenRai
- Disclosed: 2025-02-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-secondswap#m-12
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-12
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** SecondSwap_VestingManager.sol vesting settings
**Root cause:** setSellable treats maxSellPercent==0 as uninitialized and overwrites it with the 20% default, conflating a deliberate zero with a missing value.
**Steps:**
1. Issuer calls `setMaxSellPercent(vesting, 0)` to block selling.
2. Admin calls `setSellable(vesting, true)` to unlist due to an issue.
3. Admin calls `setSellable(vesting, true)` again to relist.
4. setSellable sees maxSellPercent==0 and resets it to 20% (and resets sellFee/buyFee to defaults).
5. Users can now sell up to 20% of vesting tokens against issuer intent.
**How found:** Code reading of setSellable/setMaxSellPercent interaction, noticing 0 is overloaded as both a valid setting and an uninitialized sentinel.
**Exploitation:** No attacker action needed; the admin's relist call silently re-enables selling at 20% and resets fees, violating issuer configuration.
**Insight:** When a config value uses 0 as both a legitimate setting and an 'uninitialized' sentinel, any re-init path can silently overwrite deliberate zeros; check setters that reset defaults on relist/enable.