Skip to content
attack.paths
Connexion
← RegistryDossier · 5 steps · 4 edges

Vesting beneficiary replace → silently drain stream

Bug in a custom vesting contract allows anyone to call setBeneficiary on existing schedules. Replace beneficiary with attacker address; legitimate token stream now flows to attacker until released funds are noticed.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target deployed a custom vesting / streaming contract (Sablier-like). Either an unguarded setBeneficiary or a delegatecall path lets an external caller set arbitrary beneficiaries.

§ Steps

  1. 01
    Claim the stream to attacker addressExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Wait for vesting unlockInitial Access
    T1078— Valid Accounts
  3. 03
    Audit vesting contract sourceReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  4. 04
    Call setBeneficiary on victim's scheduleImpact
    DEFI-VESTING-DRAIN— Vesting Contract Drain
  5. 05
    Spot missing access controlPrivilege Escalation
    DEFI-VESTING-PERM— Vesting Beneficiary Replace

§ References

§ Frequently asked

What is the "Vesting beneficiary replace → silently drain stream" attack path?
Bug in a custom vesting contract allows anyone to call setBeneficiary on existing schedules. Replace beneficiary with attacker address; legitimate token stream now flows to attacker until released funds are noticed. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Claim the stream to attacker address (T1041) — a exfiltration primitive. Assumed environment: target deployed a custom vesting / streaming contract (Sablier-like).
What is the final impact of this kill-chain?
The final step lands on Spot missing access control (DEFI-VESTING-PERM), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers