# MarketPlace Change In Vesting Manager, Leads To Loss Of Previous MarketPlace Listing

Changing the Marketplace address in VestingManager orphans all listings on the old marketplace, making them unlistable and unpurchasable, locking users' vested tokens.

- Payout: Contest reward
- Severity: medium
- Program: SecondSwap
- Credited: franfran20
- Disclosed: 2025-02-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-secondswap#m-13
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-secondswap%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** VestingManager / MarketPlace smart contracts
**Root cause:** setMarketplace overwrites the single marketplace address; onlyMarketplace modifier then rejects calls from the old marketplace, so its listings can no longer be unlisted or purchased.
**Steps:**
1. User lists 200 of 1000 vested tokens on MarketPlace A; VestingManager.marketplace = A.
2. Admin calls VestingManager.setMarketplace(B).
3. Old MarketPlace A calls unlistVesting/completePurchase on VestingManager.
4. onlyMarketplace modifier reverts: msg.sender (A) != marketplace (B).
5. Listings on A are stuck; freeze also blocks unlist/purchase, so no recovery path.
**How found:** Code review of VestingManager's setMarketplace and onlyMarketplace modifier, noticing the single-address design and that freeze blocks the only user recovery path (unlist).
**Insight:** When a contract stores a single trusted caller address that admins can rotate, check whether state created under the old caller becomes unreachable; also check that any 'freeze' safety mechanism doesn't simultaneously block the user's escape hatch (unlist/withdraw).