# Verifier::checkQuorum() returns false with more than 3 signers Low/Info · Three Sigma · Hybrid orderbook DEX · 3rd April 2024 Finding 3S-Vertex-L01 of the Vertex security review. - Report: /reports/vertex - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-04-03-vertex.pdf --- ### Description The [signerBitmask](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/blob/4286c37cf4ee59d7e3231ac4683859f54d0d8e96/contracts/Endpoint.sol#L751) is hardcoded to 7 when calling [requireValidSignature(),](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/blob/4286c37cf4ee59d7e3231ac4683859f54d0d8e96/contracts/Verifier.sol#L114) meaning that [nSigned](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/blob/4286c37cf4ee59d7e3231ac4683859f54d0d8e96/contracts/Verifier.sol#L111) would be incremented at most 3 times in [checkQuorum()](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/blob/4286c37cf4ee59d7e3231ac4683859f54d0d8e96/contracts/Verifier.sol#L100) as 7 = 00000111. Consequently, if there are more than 3 signers added in the Verifier contract, Verifier::checkQuorum() will always return false in the following scenarios: - nSigner >= 4 and nSigned <= 2 - nSigner >= 6 and nSigned <= 3 ### Recommendation Make signerBitmask dynamic. ### Status Addressed in [#38bbe76](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/commit/38bbe768d64139b9de91a065f4bdd1cb1e212198). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [RedeemQueue::getAvailableResolveRange() incorrectly returns false if from == count - 1](https://0xsimao.com/findings/mitosis-redeem-queue-resolve-range): Mitosis - [Signer duplicate check can be performed by requiring signers being sent ordered](https://0xsimao.com/findings/orange-signer-requiring-signers-ordered): Orange Bridge