# RedeemQueue::findOffsetIndex() does not check the last index Low/Info · Three Sigma · Cross-chain liquidity layer 1 · 25th June, 2024 Finding 3S-Mitosis-N07 of the Mitosis security review. - Protocol: https://mitosis.org/ - Report: /reports/mitosis - Source: https://cdn.sanity.io/files/qoqld077/production/b6b3bd7bb47407d99e76abb7c6dc615c1db5018e.pdf --- ### Description RedeemQueue::findOffsetIndex() performs binary search but does not check the last index when doing so, as it assigns uint256 r = len_ - 1;. For example, consider l == 0, len == 3, so r == 2 and [there](https://docs.soliditylang.org/en/latest/style-guide.html) are requests 0, 1 and 2. First iteration, m == 0 + (2 - 0) / 2 == 1. isReserved() returns true l == m + 1 == 1 + 1 == 2 and it leaves the while loop as l == r == 2. Thus, the last index is not checked (m == 2). ### Recommendation uint256 r = len_; would correctly check index 2 and assign l to 3 in this case. Additionally, consider exposing this function in the BasicVault as it currently is not. ### Status Addressed in [#bed727e](https://github.com/mitosis-org/evm/pull/205/commits/bed727e3f44841436864af64ff59eda73babb50b). --- Related findings: - [Queue MapleWithdrawalManager may revert due to honest removeShares() or manual redeem calls](https://0xsimao.com/findings/maple-finance-ii-queue-withdrawal-shares-redeem): Maple Withdrawal Manager - [OstiumTrading::topUpCollateral() is missing pairsStored.groupMaxCollateral(pairIndex) check](https://0xsimao.com/findings/ostium-collateral-pairs-stored-index): Ostium - [`SyrupBitcoinRouter::requestRedeem()` could also check if the asset picked to redeem has liquidity](https://0xsimao.com/findings/maple-finance-iii-syrup-bitcoin-redeem-picked): Maple Withdrawal Queue