# BRC20Factory and Vault do different checks when removing signers Low/Info · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-N02 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description BRC20Factory checks if the account is authorized and if its index stored in indexes[account] is smaller than the length of signers. Vault requires that the length of signers is bigger than 1 and the account is authorized. ### Recommendation The check that the index of the account is smaller than the length of signers is not required and can be removed. Also, decide if it makes sense to check if the length of the signers is bigger than 1 in the BRC20Factory or if this check is not required in both contracts. ### Status Acknowledged --- Related findings: - [BasicVaultFactory::createVault() inconsistent already existing vault check](https://0xsimao.com/findings/mitosis-create-inconsistent-already-existing): Mitosis