# MerkleTreeOperator::getMerklePath() will revert due to OOG after enough elements Low/Info · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-L09 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description MerkleTreeOperator::getMerklePath() [searches](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/master/contracts/core/MerkleTreeOperator.sol#L146-L151) the tree in linear time for the index of the requested _noteCommitment. Thus, it will run out of gas or timeout when using rpc providers when enough leaves are added. ### Recommendation Store the index of each leaf in a mapping. ### Status Acknowledged --- Related findings: - [Slashing fails when node operator doesn't have enough staked `GGP`](https://0xsimao.com/findings/gogopool-slashing-fails-node-ggp): GoGoPool - [.values() may revert when calling getWatchList() due to OOG](https://0xsimao.com/findings/ostium-revert-watch-list-oog): Ostium - [getTriggerOrders() should be paginated or it may revert if enough orders are created](https://0xsimao.com/findings/nftperp-i-orders-paginated-revert-created): Nftperp Exchange