# Cancelling rounds after finalizing will lead to incorrect `globalTokenAllocPerIDORound` tracking Crit/High · Three Sigma · IDO launchpad · 7th August, 2024 Finding H-3 of the Blast IDO Pools security review. - Protocol: https://docs.blastup.io/blastup-docs - Report: /reports/blast-ido-pools - Source: https://cdn.sanity.io/files/qoqld077/production/d2a7ca81740e715b604122c12dafbce599e43f2f.pdf --- ### Description Rounds may be claimed after finalized, in which each claim reduces `globalTokenAllocPerIDORound[idoConfig.idoToken]`. When rounds are canceled and were enabled, `globalTokenAllocPerIDORound[idoConfig.idoToken]` is reduced by `idoConfig.idoSize`. Thus, it's possible for the `globalTokenAllocPerIDORound` to be reduced by more than `idoConfig.idoSize` per round in case it is finalized and canceled. This means that other rounds could not be claimed as `globalTokenAllocPerIDORound` would underflow as it had been reduced too much and it may not be possible to cancel them as it may underflow. ### Recommendation According to specs, rounds should be allowed to be canceled after finalized, so `globalTokenAllocPerIDORound[idoConfig.idoToken]` must be reduced by the amount left of `idoTokens` that were not claimed. A new variable needs to be created to track the amount of tokens that were claimed per round, such that on cancel after finalizing, `globalTokenAllocPerIDORound` can be decreased by `globalTokenAllocPerIDORound.idoTokensSold - idoRoundConfigs[idoRoundId].idoTokensClaimed`. Additionally, users should not be able to participate or claim if a round was canceled. --- Related findings: - [Token addresses are not validated in BRC20Factory and Vault, so users can use incorrect tokens](https://0xsimao.com/findings/orange-addresses-validated-brc20-factory): Orange Bridge