# Rank and multiplier of a user can not be set if the user is registered for `MetaIDO` by the admin Crit/High · Three Sigma · IDO launchpad · 7th August, 2024 Finding H-4 of the Blast IDO Pools security review. - Protocol: https://docs.blastup.io/blastup-docs - Report: /reports/blast-ido-pools - Source: https://cdn.sanity.io/files/qoqld077/production/d2a7ca81740e715b604122c12dafbce599e43f2f.pdf --- ### Description `IDOPoolAbstract::adminAddRegForMetaIDO()` sets `metaIDO.isRegistered[user] = true;`, but not the rank and multiplier. In `IDOPoolAbstract::registerForMetaIDO()` it reverts if the user is already registered `require(!metaIDO.isRegistered[msg.sender], "User already registered");`. Thus, it will be impossible to set the rank or multiplier for users registered by the admin. Additionally, there is unreachable code, `if (metaIDO.isRegistered[msg.sender])` is always `false` due to the check above requiring the user to not have been registered previously. ### Recommendation There are a few solutions, for example, when manually registering a user by the admin, the rank and multiplier can be fetched from the multiplier contract. --- Related findings: - [Admin new issuance or user calling `Vault::redeemExpiredLv()` after `Psm::redeemWithCt()` will lead to stuck funds when trying to withdraw](https://0xsimao.com/findings/cork-protocol-issuance-redeem-stuck-withdraw): Cork Protocol - [Deadline parameter in SyrupUserActions::_swapViaBalancer() could be set to minimize MEV](https://0xsimao.com/findings/maple-finance-syrup-balancer-swap-deadline): Maple Syrup