# NFTFloorOracle's asset and feeder structures can be corrupted

NFTFloorOracle stores asset/feeder list indices in uint8, so once lists exceed 255 entries indices truncate and removals delete the wrong element, corrupting the oracle.

- Payout: Contest reward
- Severity: high
- Program: ParaSpace
- Credited: hyh
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/482
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-08
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** NFTFloorOracle price oracle contract (Solidity)
**Root cause:** FeederRegistrar.index and FeederPosition.index are uint8, and _addAsset/_addFeeder assign uint8(assets.length-1)/uint8(feeders.length-1); _removeAsset also deletes without shrinking the array, so the list grows unbounded and indices wrap past 255.
**Steps:**
1. Read NFTFloorOracle.sol: structs FeederRegistrar/FeederPosition use `uint8 index`.
2. Note `_addAsset` does `assets.push(_asset); assetFeederMap[_asset].index = uint8(assets.length - 1);` and `_addFeeder` does `feederPositionMap[_feeder].index = uint8(feeders.length - 1);`.
3. Note `_removeAsset` does `delete assets[assetIndex]` without popping, so `assets.length` only grows.
4. Register assets/feeders until length exceeds 255; new index truncates (e.g. 256 -> 0).
5. Call `_removeAsset`/`_removeFeeder` on a truncated entry: `delete assets[assetIndex]` or `feeders[feederIndex] = feeders[feeders.length-1]` clears the wrong element, permanently corrupting the structure.
**How found:** Code review of the oracle's index bookkeeping: noticed uint8 index fields combined with an array that never shrinks on asset removal, making the 255 limit reachable over the system's lifetime.
**Escalation:** Corrupted asset/feeder structures make the oracle uncontrollable and can lead to collateral mispricing.
**Insight:** When auditing registries that store array indices in packed structs, check the integer width against whether the array ever shrinks; a delete-without-pop pattern makes a uint8 index limit reachable even if removals are common.