# Incorrect Removal Of Asset In UpdateAccount Due To Wrong Implementation in _movePop

ClearingHouse._movePop sets the target index to the same asset instead of the last element, so closing a position pops the wrong asset and corrupts the account's asset list.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: SeveritySquad
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-10
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-10
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ClearingHouse.sol perps accounting (asset list management)
**Root cause:** _movePop intends to swap the target element with the last element before popping, but calls array.set(index, asset) writing the same asset back, so the target stays and the last element is always popped.
**Steps:**
1. Open positions on multiple assets in one subaccount so assets array has >1 entries.
2. Close a position whose asset is not the last element; updateAccount sees amount==0 and calls _movePop(assets, tradedAsset).
3. Observe _movePop: indexOf finds index, then array.set(index, asset) rewrites same value, then array.pop() removes last element.
4. Result: closed asset remains in assets list; last (still active) asset is removed and persisted via setAssets.
**How found:** Code reading of _movePop against its stated intent (swap-with-last then pop); noticed array.set(index, asset) writes the same asset rather than the last element.
**Escalation:** Corrupted asset list can drop active positions from collateral/liability accounting, potentially letting an underwater cross-margin account avoid liquidation or making active balances unreachable.
**Insight:** When auditing swap-and-pop helpers, verify the set() argument is the last element (array.at(length-1)), not the target itself; a self-assignment silently turns swap-and-pop into plain pop.