pontifex - Incorrect vesting allocations clearing when the list of allocations updating

[sherlock-admin]

pontifex

high

Incorrect vesting allocations clearing when the list of allocations updating

Summary

The difference in start value of the baseTokenId at the Token.updateFounders and Token._addFounders functions can lead to incorrect allocation clearing.

Vulnerability Detail

The Token.updateFounders updates the list of allocation owners by clearing the previous allocations before adding new.
The function reverse engineers the indices the founder has reserved tokens in. But the initial value for the baseTokenId is always 0 while during the allocation itself the baseTokenId depends on the reservedUntilTokenId variable.

160                // Used to store the base token id the founder will recieve
161                uint256 baseTokenId = reservedUntilTokenId;
...
411                // Used to reverse engineer the indices the founder has reserved tokens in.
412                uint256 baseTokenId;

Thus the difference in start value can lead to incorrect indices calculation.

Impact

Some allocations may not be cleared and addresses from the previous list of allocations will receive an excess amount of tokens.

Code Snippet

https://github.com/sherlock-audit/2023-09-nounsbuilder/blob/db232c649b425c36f5a93607c95cfdf0e5962b2f/nouns-protocol/src/token/Token.sol#L411-L412

Tool used

Manual Review

Recommendation

Consider using reservedUntilTokenId as a start value of baseTokenId.

Duplicate of #42