# initiallastpoint mismanagement compromises epoch accuracy and snapshot governance

In ZeroLocker's _checkpoint, `Point memory initialLastPoint = lastPoint` aliases instead of copying, so epoch block numbers stay pinned to the first checkpoint, corrupting balanceOfAtNFT/totalSupplyAt snapshots.

- Payout: Contest reward
- Severity: medium
- Program: Zerolend
- Credited: elhaj
- Disclosed: 2024-09-16
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_zerolend_jan2024.pdf#3.2.14
- Library page: https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.14
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** ZeroLocker.sol governance checkpoint/snapshot logic
**Root cause:** Solidity memory struct assignment `initialLastPoint = lastPoint` shares the same memory reference rather than copying, so later mutations of lastPoint also mutate initialLastPoint, making (tI - initialLastPoint.ts) always zero.
**Steps:**
1. Read `_checkpoint` in ZeroLocker.sol (L558/L973): `Point memory initialLastPoint = lastPoint;`
2. Note lastPoint is later mutated (`lastPoint.ts = tI; lastPoint.blk = ...`)
3. Because both names alias one memory struct, initialLastPoint.ts becomes tI, so the extrapolation term is 0 and lastPoint.blk stays at the first checkpoint's block
4. Run the forge PoC: assign struct, mutate lastPoint.bias/slope, assert initialLastPoint.bias == 200
5. Observe `totalSupplyAt` divides by `(pointNext.blk - point.blk)` which is now zero → revert
**How found:** Code-reading of the checkpoint extrapolation logic; noticed the comment claiming initialLastPoint preserves the original state, then reasoned about Solidity memory reference semantics for structs to show the copy never happens.
**Insight:** When a comment asserts a variable is a frozen snapshot, verify the assignment actually copies — Solidity memory structs alias, so `Point memory b = a` is a reference; only storage-to-memory or explicit field construction copies.