# BasicVaultFactory::createVault() inconsistent already existing vault check Low/Info · Three Sigma · Cross-chain liquidity layer 1 · 25th June, 2024 Finding 3S-Mitosis-N03 of the Mitosis security review. - Protocol: https://mitosis.org/ - Report: /reports/mitosis - Source: https://cdn.sanity.io/files/qoqld077/production/b6b3bd7bb47407d99e76abb7c6dc615c1db5018e.pdf --- ### Description BasicVaultFactory::createVault() reverts with a vault already created error whenever $.vaultIds[vault] != 0 && $.vaults[$.vaultIds[vault]] != vault. This is problematic because the vault with id == 0 will not revert due to this error (but still reverts later as the creation will fail) and $.vaults[$.vaultIds[vault]] is always vault, as it is impossible to have mismatching vaults and vault ids. ### Recommendation Vault ids could start at 1 instead so index 0 is never confused with not having been created. This way it is enough checking the vault to id mapping. ### Status Addressed in [#7c8ca62](https://github.com/mitosis-org/evm/pull/203/commits/7c8ca629999dfc1aaeaaa4d6b57d0cb927030ee9). --- Related findings: - [SpiritVestingFactory::createSpiritVestingContract overwrites the spiritVestings mapping for the same recipient](https://0xsimao.com/findings/spirit-protocol-vesting-overwrites-vestings-recipient): Spirit Protocol - [KeyringCoreV2Base::_createCredential() could use currentTime instead of block.timestamp on the creatBefore check](https://0xsimao.com/findings/keyring-ii-credential-current-timestamp-creat): Keyring Credentials - [KeyringCoreV2Base::blacklistEntity() and KeyringCoreV2Base::unblacklistEntity() could check that the addresses are not already set](https://0xsimao.com/findings/keyring-ii-blacklist-entity-unblacklist-addresses): Keyring Credentials - [Funding cap in `IDOPoolAbstract::_basicParticipationCheck()` is imprecise and can lead to excessive tokens sold](https://0xsimao.com/findings/blast-ido-pools-participation-imprecise-excessive-sold): Blast IDO Pools