# Maturity Linked List breaks if you add an order with the maturity = _recentestMaturity

Inserting an order whose maturity equals _recentestMaturity makes the maturity linked list self-reference, breaking interest accrual and DoSing new orders.

- Payout: Contest reward
- Severity: high
- Program: Term Structure
- Credited: BengalCatBalu
- Disclosed: 2025-03-20
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_term_structure_february2025.pdf#3.1.7
- Library page: https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.1.7
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Vault order creation / _insertMaturity linked list (Solidity)
**Root cause:** _insertMaturity writes _maturityMapping[maturity]=nextMaturity then overwrites _maturityMapping[priorMaturity]=maturity when maturity==priorMaturity, making the node point to itself.
**Steps:**
1. Have list 1 -> 2 with _recentestMaturity = 1.
2. Call createOrder with maturity = 1 (same as _recentestMaturity).
3. In while loop, maturity < nextMaturity (1 < 2) branch executes: `_maturityMapping[1] = 2` then `_maturityMapping[1] = 1`.
4. Result: _maturityMapping[1] == 1, a self-referencing cycle.
5. Call _accruedInterest: loop never advances past maturity 1, interest for later maturities misprocessed and new order creation DoS'd.
**How found:** Code-reading of _insertMaturity's while-loop branches; noticed the maturity==nextMaturity break is bypassed when maturity equals priorMaturity, causing double-write to the same mapping key.
**Exploitation:** Any user creates a second order in the same whitelisted market (orders inherit market maturity), triggering the self-loop; subsequent _accruedInterest calls loop on the first maturity, corrupting interest accounting and blocking new orders.
**Insight:** In sorted linked-list insertion, check equality against priorMaturity (the head/current node) too, not just nextMaturity; duplicate keys on the head node cause self-loops that hang iteration-based accounting loops.