Audit Issue - LockupVolumeRestrictionTM.sol

[adamdossa]

The following scenario still breaks the intended behavior of LockupVolumeRestrictionTM, "Lock 3 wei, wait for two to be unlocked but transfer only one, then wait for the final one to unlock and try to transfer the remaining two, this should be possible but isn't". Though the contract is currently not meant for production, this test case should be documented for future reference.

[adamdossa]

@satyamakgec Trying to understand this bug a bit more...

AFAICT, in this scenario:

uint elapsedPeriods = (now.sub(lockUps[userAddress].startTime)).div(lockUps[userAddress].releaseFrequencySeconds);
=> elapsedPeriods == 3
uint allowedAmount = amountPerPeriod.mul(elapsedPeriods).sub(lockUps[userAddress].alreadyWithdrawn);
=> allowedAmount == 3 - 1 == 2

So you would be able to withdraw the 2 WEI. Is there something I'm missing?

[satyamakgec]

I don't think so, It is working as intended