# Vouchers and vouchees indices become corrupted by UserManager's cancelVouch

UserManager.cancelVouch swaps the last vouchers/vouchees array element into the deleted slot but never updates its index mapping, corrupting accounting and freezing staker funds.

- Payout: Contest reward
- Severity: medium
- Program: Union Finance
- Credited: Ch_301
- Disclosed: 2022-11-04
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-union-finance-judging/issues/157
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-union-finance%3AM-1
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** UserManager.sol vouch accounting (vouchers/vouchees arrays and index mappings)
**Root cause:** cancelVouch moves the last array element into the removed index and pops, but fails to update voucherIndexes/voucheeIndexes for the moved element, leaving a stale index pointing at the array length or at a later-inserted entry.
**Steps:**
1. Staker vouches for borrower B1 and B2 so vouchers[B1] has multiple entries.
2. Call `cancelVouch(staker, B1)` where B1 is not the last element; the last voucher is moved into B1's slot and popped.
3. Observe `voucherIndexes[B1][lastStaker].idx` still equals old length, so `getLockedStake`/`getVouchingAmount` revert out-of-bounds.
4. Add a new vouch via `updateTrust()`; the stale index now points at the new entry, returning wrong trust/locked values.
5. Attempt `updateTrust` with trust < real locked, or `cancelVouch` blocked by phantom `locked > 0`.
**How found:** Code review of the swap-and-pop pattern in cancelVouch; noticed the index mapping update was missing for the relocated last element, then traced downstream functions reading voucherIndexes to confirm revert and stale-pointer effects.
**Exploitation:** Borrower with a stale index can exploit the phantom trust: staker cannot cancel the vouch because the moved entry's locked>0 blocks cancelVouch, letting the borrower keep utilizing trust the staker intended to revoke, effectively freezing staker funds.
**Escalation:** Repeated cancelVouch calls pile up misplaced indices, compounding incorrect locked/trust accounting across multiple borrower-staker pairs.
**Insight:** Whenever a contract uses swap-and-pop on an array paired with an index mapping, verify the mapping entry for the moved element is rewritten; a missing update silently corrupts accounting and can be weaponized to block cancellations and lock funds.