# Lockup of vestings or completion time can be bypassed due to missing check for staked tokens

Vesting batches don't track staked tokens, so a recipient can claim a matured vesting while its tokens are staked, pulling funds from another still-locked vesting.

- Payout: Contest reward
- Severity: medium
- Program: Andromeda Ado
- Credited: J4X_
- Disclosed: 2024-05-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-andromeda-ado-judging/issues/58
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-14
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** CosmWasm Vesting ADO contract (claim_batch / execute_delegate)
**Root cause:** Batch struct tracks amount and amount_claimed but not amount_staked, so claim_batch computes amount_available from the contract's total balance rather than the batch's unstaked balance, letting a staked batch claim tokens belonging to other batches.
**Steps:**
1. Create VestingA of 100 tokens with lockup_end in 1 month, full release.
2. Call `execute_delegate()` to stake all 100 tokens of VestingA.
3. Create VestingB of 100 tokens with lockup_end in 10 years.
4. After 1 month, call `execute_claim()` for VestingA while its tokens remain staked.
5. claim_batch sees total contract balance (VestingB's 100 tokens) and pays out VestingA, bypassing VestingB's lockup.
**How found:** Code review of claim_batch: noticed amount_available uses total contract balance and batch.amount - amount_claimed without accounting for tokens moved out via execute_delegate staking, then constructed a two-vesting scenario to demonstrate the bypass.
**Exploitation:** Recipient stakes a matured vesting's tokens, then claims that vesting; since claim_batch only checks the contract's aggregate balance, the payout is drawn from another vesting still inside its lockup period, effectively unlocking those tokens early.
**Escalation:** With multiple vestings, the attacker can drain locked batches by repeatedly claiming staked matured batches against the pooled balance.
**Insight:** When a contract pools funds across per-user accounting entries, check whether any outbound action (staking, delegation, lending) removes tokens from the pool without decrementing the entry's available balance; aggregate-balance checks then let one entry spend another's locked funds.