# Collateral parameters can be overwritten

Whitelist.addCollateral's duplicate check is bypassed when re-adding validCollateral[0], overwriting collateralParams and duplicating the token in validCollateral.

- Payout: Audit contest
- Severity: medium
- Program: Yeti Finance
- Found by: cmichel
- Disclosed: 2022-03-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-yetifinance-findings/issues/198
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-yetifinance%3AM-06
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Whitelist.addCollateral (Solidity smart contract)
**Root cause:** The duplicate guard `validCollateral[0] != _collateral` short-circuits to false when _collateral equals the first entry, skipping the `collateralParams[_collateral].index == 0` require, so the entry is pushed again and its params overwritten.
**Steps:**
1. Owner calls `addCollateral(_collateral=validCollateral[0], _minRatio, _oracle, _decimals, _priceCurve, _isWrapped)`.
2. Condition `validCollateral.length != 0 && validCollateral[0] != _collateral` evaluates false, skipping the require.
3. `validCollateral.push(_collateral)` duplicates the token.
4. `collateralParams[_collateral]` is reassigned with new minRatio/oracle/decimals/index, overwriting prior config.
**How found:** Code reading of the addCollateral guard: noticed the `validCollateral[0] != _collateral` condition makes the require unreachable when the argument equals the first element, allowing re-initialization.
**Exploitation:** Requires owner (privileged) call; re-adding the first collateral token overwrites its CollateralParams and duplicates it in validCollateral, breaking accounting that iterates the list.
**Insight:** When a duplicate-check guard combines an index-0 sentinel with an inequality against the first element, test re-adding element 0 — the sentinel comparison can short-circuit the real existence check.