# Don't return the same memory variable if your passing it as argument Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-N19 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description In BaseRouter, _bundleInternal(...), the tokensToCheck array is updated in tokensToCheck = _addTokenToList(token, tokensToCheck);. In _addTokenToList(...), the token is added to the array if it is not present yet, which modifies the tokensToCheck in the outer scope of the function; there is no need to return it - when a variable is passed as memory to an internal function, the same memory location is used, solidity does not create a copy. ### Recommendation Change _addTokenToList(...) to not return anything. ### Status Addressed here: [Fujicracy/fuji-v2#622](https://github.com/Fujicracy/fuji-v2/pull/622) --- Related findings: - [DoSed `Voter::finalize()` due to unbounded pending removals lacking a batch argument variable](https://0xsimao.com/findings/bmx-voter-unbounded-removals-lacking): BMX