# _ownedTokensIndex is SHARED by different owners, as a result, _removeTokenFromAllTokensEnumeration might remove the wrong tokenId. 

ERC1155Enumerable shares one _ownedTokensIndex mapping across all owners, so removing a token can delete the wrong tokenId from another owner's enumeration list.

- Payout: Contest reward
- Severity: medium
- Program: Timeswap
- Credited: chaduke
- Disclosed: 2023-03-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-timeswap-findings/issues/168
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-timeswap%3AM-06
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** ERC1155Enumerable.sol token enumeration (ERC-1155)
**Root cause:** _ownedTokensIndex maps tokenId to index globally instead of per-owner, so _addTokenToOwnerEnumeration for one owner overwrites the index another owner relies on; _removeTokenFromOwnerEnumeration then reads a stale index and swaps/deletes the wrong tokenId.
**Steps:**
1. Alice owns tokens A,B,C at indices 1,2,3 in _ownedTokens[Alice].
2. Bob adds token A via _addTokenToOwnerEnumeration, writing _ownedTokensIndex[A]=2 (shared mapping).
3. Call _removeTokenFromOwnerEnumeration(Alice, A): tokenIndex=_ownedTokensIndex[A]=2, which points to B.
4. Function overwrites _ownedTokens[Alice][2] with lastTokenId and deletes index 2, removing B instead of A.
**How found:** Code reading of the enumeration helpers: noticed _ownedTokensIndex is a single mapping keyed only by tokenId while _ownedTokens is keyed by owner, implying cross-owner index collisions.
**Insight:** When auditing enumerable-token extensions, check that every index/auxiliary mapping is keyed by owner as well as tokenId; a globally keyed index alongside per-owner arrays is a classic corruption source.