# In OstiumTradesUpKeep, _getLimitOrdersToTrigger() and _getOpenOrdersToTrigger() return tradesToTrigger with 1 extra length Low/Info · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-N15 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description In [OstiumTradesUpKeep::_getLimitOrdersToTrigger()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTradesUpKeep.sol#L244-L248) and [OstiumTradesUpKeep::_getOpenOrdersToTrigger()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTradesUpKeep.sol#L363-L367), tradesToTrigger are returned with 1 extra length due to incorrect ++tradesToTrigger operation. tradesToTriggerIndex starts at 0 and increases whenever a trade is found, so it is always ahead of the biggest index by 1 already, representing the length. ### Recommendation Remove ++ from the conditions if (++tradesToTriggerIndex < tradesToTrigger.length). Additionally, check if the length of the array [here](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTradesUpKeep.sol#L137) is 0 instead of the first trader. ### Status Addressed in [#8ff89f3](https://github.com/0xOstium/smart-contracts-threeSigma/pull/58/commits/8ff89f3b269048474771649f5341421fd8e3b299). --- Related findings: - [getTriggerOrders() should be paginated or it may revert if enough orders are created](https://0xsimao.com/findings/nftperp-i-orders-paginated-revert-created): Nftperp Exchange