# In StakingAssetManager::lockERC20() the resulting note is created with asset instead of zkToken Crit/High · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-C01 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description Users can transfer tokens to the StakingAssetManager in return for a note commitment of the corresponding zkToken. However, StakingAssetManager::lockERC20() builds the note using args.asset, which is the asset itself, which will lead to problems (will not be able to unlock). ### Recommendation Build the note using zkToken instead. ### Status Addressed in [#ab8b4b9](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/ab8b4b914eebe7b9a8e6199429be30e2bbb9c16c). --- Related findings: - [Users will lock raffle prizes on the `WinnablesPrizeManager` contract by calling `WinnablesTicketManager::propagateRaffleWinner` with wrong CCIP inputs](https://0xsimao.com/findings/winnables-raffles-lock-propagate-ccip-inputs): Winnables Raffles - [OstiumPriceUpKeep Verifies Reports Using Native Token Instead of LINK](https://0xsimao.com/findings/ostium-price-verifies-reports-native): Ostium - [DoSed liquidations as `PrizeVault::liquidatableBalanceOf()` does not take into account the `mintLimit` when the token out is the asset](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-liquidations-prize-liquidatable-mint): PoolTogether Prize Layer