# Signer duplicate check can be performed by requiring signers being sent ordered Low/Info · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-N05 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description Signers are checked for duplicates by creating a memory signers array and looping through this array for every new signer, which is inefficient. ### Recommendation Cache the last signer and assert that the current signer is bigger than the last, require(signer > prevSigner, "duplicate". This is how Gnosis Safe does it, for example. ### Status Addressed in [#b03ca97](https://github.com/orangecryptohq/orange-bridge-contract/commit/b03ca973f345eb72f59fc3914af37b386c734ec9). --- Related findings: - [BaseFlasher transfers tokens and then calls xBundle(...), so the sent tokens can't be returned due to the balance check](https://0xsimao.com/findings/fuji-finance-flasher-transfers-bundle-returned): Fuji Finance - [MapleLoan, proposeNewTerms() could have a check for duplicate selectors.](https://0xsimao.com/findings/maple-finance-iii-propose-terms-duplicate-selectors): Maple Finance - [Duplicate size to fill check in _staticFillToAmm()](https://0xsimao.com/findings/nftperp-ii-duplicate-size-fill-static): Nftperp Matching Engine