Submission Details
Impact:
Likelihood:
`_resetPerAddressTracking()` should reset `sender` not `address(0)`
Author Revealed upon completion
Description
_resetPerAddressTracking() should reset sender not address(0).
https://github.com/CodeHawks-Contests/2026-01-vanguard/blob/main/src/TokenLaunchHook.sol#L189
function _resetPerAddressTracking() internal {
addressSwappedAmount[address(0)] = 0;
addressLastSwapBlock[address(0)] = 0;
}
Here the reset doesn't do anything for the user/sender.
The mappings that track the user's activity are never reset:
mapping(address => uint256) public addressSwappedAmount;
mapping(address => uint256) public addressLastSwapBlock;
When the phase changes, the stored state for each user remains unchanged.
As a result, the penalties and limits calculated in _beforeSwap continue to apply based on the previous phase.
Mitigation:
Use this code instead :
function _resetPerAddressTracking(address sender) internal {
addressSwappedAmount[sender] = 0;
addressLastSwapBlock[sender] = 0;
}
Rewards breakdown
nSLOC
273This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.