# `createCommonProjectIDAndDeploymentRequest()` hardcodes request id index to 0, leading to lost requests for users Medium · Sherlock · AI agent · 11th March 2025 Finding M-1 of the Crestal Network competition. - Protocol: https://audits.sherlock.xyz/contests/755 - Codebase: https://github.com/0xsimao/2025-03-crestal-network/tree/27a3c28155702b3a68f29347efedffb048010e33 - Source: https://github.com/sherlock-audit/2025-03-crestal-network-judging/issues/205 --- ### Summary `createCommonProjectIDAndDeploymentRequest()` is called by `createAgent()`, in which the user pays fees to create an agent. The [index](https://github.com/sherlock-audit/2025-03-crestal-network/blob/main/crestal-omni-contracts/src/BlueprintCore.sol#L373) is supposed to protect the user from overwritting a requestId with the same requestId but different serverURL. However, it is hardcoded to 0. ### Root Cause In `BlueprintCore:373`, index is 0. ### Internal Pre-conditions None. ### External Pre-conditions None. ### Attack Path 1. User creates an agent for a certain projectId, base64Proposal, server url. 2. User creates an agent (at the same block) with the same projectId, base64Proposal but different server url. 3. First request is overwritten. ### Impact First request is overwritten and one of them will not be finalized as `submitProofOfDeployment()` and `submitDeploymentRequest()` can only be called once as part of the final steps by the worker. However, the user paid fees for both requests, but only one of them will go through. ### PoC See above. ### Mitigation Index should be increment in a user mapping. --- Related findings: - [BasicVault::getRedeemRequestOf() will revert as the redeem requests are filled with the wrong indexes](https://0xsimao.com/findings/mitosis-redeem-revert-filled-indexes): Mitosis - [reqID_pendingAutomationOrder stores the index of the trade, which could point to a different trade since the request was created](https://0xsimao.com/findings/ostium-req-index-point-since): Ostium - [Users cannot unstake from YiedlETHStakingEtherfi.sol, because YieldAccount.sol is incompatible with ether.fi's WithdrawRequestNFT.sol](https://0xsimao.com/findings/benddao-unstake-eth-staking-yield): BendDAO