# StakingOperator::setCollateralToken() will cause issues if it changes tokens relations that have already been set Low/Info · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-L02 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description Tokens are locked and unlocked, minting and burning zkTokens in the process, respectively. Thus, if zkTokens have been minted, but then the mappings between original and collateral tokens are changed, it will burn other zkTokens, leading to issues. ### Recommendation Either place an explicit check in the function to ensure the mappings have not been already created or keep this in mind. ### Status Addressed in [#6e589cb](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/6e589cb1cc0972f09cb37ca0efac157d672485c1), [#dc4f4a4](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/dc4f4a4b5c1a8cee66e65fc053d202ba96fb41b7). --- Related findings: - [Hints on withdrawal may fail as the ICR changes between claiming collateral surplus and repaying debt](https://0xsimao.com/findings/beraborrow-i-hints-withdrawal-collateral-debt): Beraborrow Managed Dens - [KeyringCoreV2Base::blacklistEntity() and KeyringCoreV2Base::unblacklistEntity() could check that the addresses are not already set](https://0xsimao.com/findings/keyring-ii-blacklist-entity-unblacklist-addresses): Keyring Credentials - [Anyone can get the NFT collateral token after an Auction without bidding due to missing check on msg.sender](https://0xsimao.com/findings/benddao-nft-collateral-auction-bidding): BendDAO - [It's possible to borrow, redeem, transfer tokens and exit markets with outdated collateral prices and borrow interest](https://0xsimao.com/findings/venus-protocol-isolated-pools-borrow-redeem-collateral-interest): Venus Protocol Isolated Pools