# QuickAccManager.sol#cancel() Wrong hashTx makes it impossible to cancel a scheduled transaction

QuickAccManager.cancel() computed hashTx without the final bool param, so the hash never matched scheduled[] and scheduled transactions could not be cancelled.

- Payout: Audit contest
- Severity: high
- Program: Ambire
- Found by: WatchPug
- Disclosed: 2021-11-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-ambire-findings/issues/1
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-ambire%3AH-02
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** QuickAccManager.sol cancel() scheduled-transaction cancellation
**Root cause:** cancel() builds hashTx via abi.encode(address(this), block.chainid, accHash, nonce, txns) omitting the trailing `false` bool used when the transaction was scheduled, so the lookup key never matches scheduled[hashTx].
**Steps:**
1. Read QuickAccManager.sol#cancel() L91: `bytes32 hashTx = keccak256(abi.encode(address(this), block.chainid, accHash, nonce, txns));`
2. Compare with the scheduling path which encodes the same fields plus a trailing `false`
3. Call cancel() with a valid sig for a scheduled tx: require(scheduled[hashTx] != 0) reverts because the key differs
4. Fix: append `false` to the abi.encode in hashTx
**How found:** Code review of cancel() against the scheduling hash construction; noticed the encoded parameter list was missing the trailing bool present elsewhere.
**Insight:** When a contract keys storage by a hash of parameters, diff the encode() argument list at every write and read site; a single missing constant (like a bool flag) silently breaks lookups.