# SpectraExchangeHook incorrectly decodes usePrevHookAmount

SpectraExchangeHook decoded usePrevHookAmount from byte offset 0 instead of 24, so the selector's first byte set the flag and wrong amounts were processed.

- Payout: Contest reward
- Severity: medium
- Program: Superform
- Credited: T1MOH
- Disclosed: 2025-07-17
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.2.19
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.19
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** SpectraExchangeHook hook contract (build/decode logic)
**Root cause:** USE_PREV_HOOK_AMOUNT_POSITION was set to 0 while the data layout places the bool at index 24 after the 24-byte sourceOracleId/yieldSourceAddress buffer, so the first selector byte was decoded as the flag.
**Steps:**
1. Craft hook data with bytes4 placeholder + address yieldSource in first 24 bytes, bool at index 24, uint256 value at 57
2. Call SpectraExchangeHook.build(prevHook, account, data)
3. Observe _decodeBool(data, 0) reads the selector's first byte instead of index 24
4. Non-zero first byte yields usePrevHookAmount=true, causing updatedTxData or arbitrary prev-hook amount to be used
**How found:** Code reading of the documented data layout comment versus the constant USE_PREV_HOOK_AMOUNT_POSITION = 0; noticed other hooks reserve 24 bytes for sourceOracleId/yieldSourceAddress so actual data starts later.
**Insight:** When a hook's data layout has a fixed 24-byte header, verify every decode offset against the documented comment; a bool read at offset 0 silently consumes the function selector's first byte.