# Reusing the same rho and pubKey in different deposits leads to lost tokens Crit/High · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-C07 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description The [nullifier](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/master/circuits/fuzk/src/lib.nr#L106-L113) is formed from rho and the schnorr pubKey. This means that depositing with different assets and amounts will still have the same nullifier, leading to the inability to move the following deposits with the same rho and pubKey. Check the poc [here](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/cfa1fc63fc2258eb2db18df687db8b9b184bd8cf) for details. ### Recommendation Either enforce the nullifier uniqueness (via unique rho and pubkey combination) or use the note as nullifier. ### Status Addressed in [#8b300f0](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/8b300f07a28f2c073154c8de3e9e90ba64ef1934). --- Related findings: - [Lost nfts due to smart wallets having different addresses on different chains](https://0xsimao.com/findings/metazero-i-nfts-wallets-having-addresses): MetaZero Omnichain NFTs - [_crossTransfer(...) reverts for smart contracts that don't share the same address on different chains](https://0xsimao.com/findings/fuji-finance-cross-transfer-reverts-share): Fuji Finance - [Proposals in the same voting period can have different ids but do the same](https://0xsimao.com/findings/m-0-proposals-voting-period-ids): M^0 Minter Gateway - [mintGenesis() mints with a push pattern using _mint() which may lead to lost tokens](https://0xsimao.com/findings/metazero-i-mint-genesis-mints-push): MetaZero Omnichain NFTs