# Migration can permanently fail if user specifies different lengths for selectors and plugins

Migration.propose() lacks a length check between selectors and plugins arrays, so a mismatched proposal makes vault.install() revert and permanently locks vault assets.

- Payout: Contest reward
- Severity: high
- Program: Fractional
- Credited: scaraven
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/115
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-19
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Vault migration module (Migration.sol propose / Vault.install)
**Root cause:** propose() stores selectors and plugins without verifying equal lengths; install() later indexes plugins by selector index, causing out-of-bounds revert when selectors.length > plugins.length.
**Steps:**
1. Call `Migration.propose(_vault, _modules, _plugins, _selectors, _newFractionSupply, _targetPrice)` with `_selectors.length > _plugins.length`
2. Gather enough users to join the proposal and start the buyout bid
3. Buyout bid succeeds, triggering `settleVault()` and migration
4. `create()` -> `registry.deployFor()` -> `vault.install(selectors, plugins)` reverts on out-of-bounds array access
5. Migration fails; no new migration can start, assets locked in vault
**How found:** Code review of propose()/install() array handling; noticed no length equality check between selectors and plugins, then traced the install() indexing to an out-of-bounds revert.
**Exploitation:** Attacker submits a migration proposal with more selectors than plugins at no cost; once the buyout succeeds, install() reverts and the vault's assets are permanently locked.
**Insight:** When two parallel arrays are stored in one function and consumed by index in another, check length equality at the storage boundary, not just at consumption—mismatch can brick an irreversible state transition like vault migration.