# Closing out Sukukfi: call-sequence bugs and self-transfers that inflate a balance

Mentorship Series #5 · 6 December 2025 · [@0xfirefist](https://x.com/0xFireFist) · Sukukfi · Code4rena

Mentorship Series · [The Contest Academy](https://0xsimao.com/the-contest-academy) · 0xSimao

---

We finished the Sukukfi [contest](https://code4rena.com/audits/2025-11-sukukfi) on Code4rena, unfortunately we were starting to understand how it all works but we ran out of time, better luck next time! 0xfirefist audited only one of the in-scope contracts and still came up with 2 submissions. Many new things learned, the base is set! Onto the next one!

**Lesson Summary:**

- Do awkward things with the 3-step flows. Think through different scenarios and call sequences, and see if anything breaks.
- Only walk a specific flow once you know the in-scope contracts, that is, once you understand them to a decent level.
- ERC20 transfer(update) can hide a bug if the update function isn't using storage, but memory - only the last change happens, previous are ignored. So must check if self transfers can inflate balance.

https://youtu.be/UTmxzSRSCJY

Session video: https://youtu.be/UTmxzSRSCJY

---

Newer: [Auditing a diff: rebuild it locally, note what you do not understand, then ask what it broke](https://0xsimao.com/the-contest-academy/mentorship-series-6) · Older: [Sponsor answers on the three-step vault: who eats a share price move, and why the delay exists](https://0xsimao.com/the-contest-academy/mentorship-series-4)