# Checks effects interactions pattern is not always followed Low/Info · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-N04 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description In StakingAssetManager::unlock(), fees are forwarded before marking the nullifier as used by calling _postWithdraw(). Although this is not exploitable because the call is permissioned by the relayer and it's not possible to register the same nullifier more than once, the pattern should always be followed to prevent future issues (if the code changes). ### Recommendation Forward the fees after recording all state changes. ### Status Addressed in [#89d8e20](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/89d8e205a679e25b9222798b1efc13e14544f8d1), [#189f399](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/189f399b0f5780c126c2cb264d6a39b0c04a2403). --- Related findings: - [Checks effects interactions pattern is now always followed](https://0xsimao.com/findings/orange-effects-interactions-now-followed): Orange Bridge - [Checks effects interactions pattern should always be used](https://0xsimao.com/findings/glacier-checks-effects-interactions-pattern): Glacier - [completeUnstake() not following checks-effects-interactions pattern](https://0xsimao.com/findings/metazero-ii-complete-unstake-following-interactions): MetaZero Staking - [CEI pattern is not followed in `GovernorTimelock::executeProposals()`](https://0xsimao.com/findings/maple-finance-ii-cei-followed-timelock-proposals): Maple Governor Timelock