A flaw in the Graph Protocol’s token vesting contracts allows early access to tokens that should be locked by the vesting schedule. This results in users receiving tokens before the intended release date, undermining the intended allocation and potentially resulting in financial loss for token holders or depositors. The weakness corresponds to improper authorization handling and an incorrect manipulation of data, as indicated by the associated CWEs.

The vulnerability affects the Graph Protocol Contracts developed by The Graph. It appears in all releases prior to version 3.0.0 that run on a Node.js environment. The latest patched release is v3.0.0; earlier versions remain vulnerable.

The CVSS score of 5.3 indicates a medium severity. EPSS is reported as less than 1 %, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker interacting with the smart contract on the blockchain network, triggering the vulnerability through normal claim functions. No public exploit has been disclosed, but the flaw allows an attacker with transactional access to claim vested tokens early, thereby gaining an advantage in token distribution.