Skip to content

VestingWallet bricked if aggregate of transfers in exceed type(uint256).max #5793

New issue
New issue
Open
#5945
Open
VestingWallet bricked if aggregate of transfers in exceed type(uint256).max#5793
#5945
Labels
bug
@arr00

Description

@arr00
arr00
opened on Jul 10, 2025

If VestingWallet receives over type(uint256).max, then the function below will revert every time it is called, effectively bricking the vesting wallet.

openzeppelin-contracts/contracts/finance/VestingWallet.sol

Lines 139 to 144 in 5def3f7

/**
* @dev Calculates the amount of tokens that has already vested. Default implementation is a linear vesting curve.
*/
function vestedAmount(address token, uint64 timestamp) public view virtual returns (uint256) {
return _vestingSchedule(IERC20(token).balanceOf(address(this)) + released(token), timestamp);
}

A user can send this value by doing the following:

  • Transfer the total supply of a token to the vesting wallet of amount type(uint256).max
  • Wait for some to vest and claim it
  • Transfer the claimed amount back to the vesting wallet

Metadata

Metadata

Assignees

No one assigned

    Labels

    bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions