Vanguard
First Flight #56
Beginner FriendlyDeFiFoundry
0 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: high

Per-Address State Reset Logic Is Broken

Author Revealed upon completion

_resetPerAddressTracking fails to reset all users accounts, this allows legitimate users to remain penalized in later phases

Description

  • During a phase transition (Phase 1 → Phase 2 → Phase 3), the hook is intended to reset all per-address anti-bot tracking so that users start each phase with fresh limits and cooldowns.


  • The _resetPerAddressTracking() function does not reset per-address state. Instead, it only zeroes mappings for address(0), leaving all real user state untouched. As a result, swap limits and cooldown penalties persist across phases, contradicting the intended design and causing users to be unfairly penalized in later phases.

function _resetPerAddressTracking() internal {
addressSwappedAmount[address(0)] = 0;
addressLastSwapBlock[address(0)] = 0;
// @> No iteration or global reset of actual user addresses
}

Risk

Likelihood:

  • Occurs on every phase transition after launch

  • Affects all users who traded in an earlier phase

Impact:

  • Legitimate users remain penalized in later phases

  • Phase-based market relaxation fails, breaking launch fairness guarantees

Proof of Concept

  1. User swaps during Phase 1 and accumulates addressSwappedAmount

  2. Phase transitions to Phase 2

  3. _resetPerAddressTracking() executes

  4. User’s addressSwappedAmount remains unchanged

  5. User immediately receives penalty fees in Phase 2


​

Recommended Mitigation

-addressSwappedAmount[address(0)] = 0;
-addressLastSwapBlock[address(0)] = 0;
+mapping(address => uint256) public lastActvePhase;
+function _getUserSwappedAmount(address user) internal view returns (uint256) {
+ if (lastActivePhase[user] != currentPhase) {
+ return 0; + }
+ return addressSwappedAmount[user];
+}
​
+function _getUserLastSwapBlock(address user) internal view returns (uint256) {
+ if (lastActivePhase[user] != currentPhase) {
+ return 0;
+ }
+ return addressLastSwapBlock[user];
+}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!