# DarkpoolAssetManager::Split() into 2 equal amounts leads to lost funds Crit/High · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-H10 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description When using [DarkpoolAssetManager::Split()](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/master/contracts/core/DarkpoolAssetManager.sol#L303), [there](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/caed73d878d323b218fbef82094264528478c61f) is no check to make sure that the 2 resulting notes are not equal, making it impossible to use the second note after the first one as the nullifier will be used by then. Check the poc here. ### Recommendation In DarkpoolAssetManager::Split() add a _noteOut1 != _noteOut2 check. ### Status Addressed in [#8b300f0](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/8b300f07a28f2c073154c8de3e9e90ba64ef1934). --- Related findings: - [`LenderCommitmentGroup_Smart` does not use `mulDiv` when converting between token and share amounts, possibly leading to DoS or loss of funds](https://0xsimao.com/findings/teller-finance-mul-div-converting-share): Teller Finance - [Lost withdrawals due to `ManagedLeveragedVault::openDen()` using all `asset()` balance](https://0xsimao.com/findings/beraborrow-i-lost-withdrawals-managed-den): Beraborrow Managed Dens - [Withdrawing all `lv` before expiry will lead to lost funds in the Vault](https://0xsimao.com/findings/cork-protocol-withdrawing-expiry-lost-funds): Cork Protocol - [In MapleLoanInitializer, the Borrower can choose a different fundsAsset than the lender.](https://0xsimao.com/findings/maple-finance-iii-initializer-borrower-choose-different): Maple Finance