# Incorrect boundaries check in GeVault's getActiveTickIndex can temporarily freeze assets due to Index out of bounds error

GeVault's getActiveTickIndex can return ticks.length-3, so deployAssets indexes ticks[ticks.length], reverting rebalance/deposit/withdraw and temporarily freezing funds.

- Payout: Contest reward
- Severity: medium
- Program: Good Entry
- Credited: 3docSec
- Disclosed: 2023-10-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-goodentry-findings/issues/379
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AM-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** GeVault.sol getActiveTickIndex / deployAssets (Solidity vault)
**Root cause:** The for loop condition `activeTickIndex < ticks.length - 3` keeps the incrementing value on exit, so the function can return ticks.length-3; deployAssets then reads ticks[tick1Index+1] = ticks[ticks.length], out of bounds.
**Steps:**
1. Deploy GeVault with 6 TokenisableRange ticks ordered by price, most above market (e.g. USDC/WETH at 1870, ranges 1751-3250).
2. Call `getActiveTickIndex()`; loop breaks at index 3 (== ticks.length-3).
3. Call `deposit`/`rebalance`; deployAssets computes tick1Index=5 and reads `ticks[6]`, reverting out of bounds.
4. Same revert blocks `withdraw` once market moves into the last ticks.
**How found:** Code-reading of the loop termination condition: noticed the post-increment value is retained on loop exit, then traced how deployAssets projects tick0Index/tick1Index+1 from the returned index.
**Insight:** When a loop's index variable is returned after the loop, the failing increment is preserved — check whether callers assume the returned index is strictly less than the loop bound minus the offsets they add.