# StakingOperator does not set isUnlockWindowActive to true in the constructor if the flag passed is true Low/Info · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-N03 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description The constructor of StakingOperator is ```solidity constructor( uint256 unlockWindowStart, uint256 unlockWindowDuration, bool isUnlockWindowActive_, address owner ) Ownable(owner) { if (isUnlockWindowActive_) { _setUnlockWindow(unlockWindowStart, unlockWindowDuration); } } ``` As can be seen, it receives a flag isUnlockWindowActive_, but never states the state variable isUnlockWindowActive. This may be intended, but flagging it because it is not clear. ### Recommendation Either place a comment or fix the issue. ### Status Addressed in [#5ad81c5](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/5ad81c5a70fa6204eb059e1cdc9efb21d2025b85). --- Related findings: - [Fluid (SUP) can be withdrawn from the Locker while the unlock flag is false](https://0xsimao.com/findings/superfluid-locker-system-ii-sup-withdrawn-flag-false): Superfluid Locker Pumponomics - [No need to set isActive to false if that mapping entry was deleted](https://0xsimao.com/findings/m-0-active-mapping-entry-deleted): M^0 Minter Gateway - [A malicious user may unlock instantly all the funds from the `FluidLocker` when no one is staking in the Tax pool](https://0xsimao.com/findings/superfluid-locker-system-unlock-instantly-staking-tax): Superfluid Locker System - [Any duration can be passed by node operator](https://0xsimao.com/findings/gogopool-duration-passed-node-operator): GoGoPool