# IncentiveBits.setOrThrow() will revert, leading to a DoS

SignerValidator's IncentiveBits.setOrThrow bit-isolation logic reverts when incentive IDs are claimed out of increasing order, letting an attacker DoS claims for a hash.

- Payout: Contest reward
- Severity: high
- Program: Boost Aa Wallet
- Credited: eLSeR17
- Disclosed: 2024-06-22
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-06-boost-aa-wallet-judging/issues/263
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-boost-aa-wallet%3AH-2
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** SignerValidator.sol IncentiveBits.setOrThrow bitmap validator
**Root cause:** The alreadySet check `xor(1, shr(incentive, updatedStorageValue))` shifts the whole bitmap rather than isolating the single incentive bit, so any lower bit already set in the storage value leaks into the result and causes a spurious revert.
**Steps:**
1. Call BoostCore.claimIncentiveFor() with validatorData.incentiveId = 5; setOrThrow sets bit 5, alreadySet = xor(1, shr(5, 0x20)) = 0, no revert.
2. Call claimIncentiveFor() again for the same hash with incentiveId = 2; updatedStorageValue = 0x24, alreadySet = xor(1, shr(2, 0x24)) = 0x08 != 0, reverts.
3. Observe that subsequent claims for that hash revert, blocking legitimate users.
**How found:** Code review of the assembly bit-manipulation in setOrThrow; noticed the shift operated on the full storage word instead of an isolated bit, then hand-traced two out-of-order incentive IDs to confirm the revert.
**Exploitation:** A user or attacker submits a claim with a high incentiveId first, then any claim using a lower incentiveId for the same hash reverts, permanently blocking remaining incentive claims for that hash.
**Insight:** When auditing bitmap/bitmask assembly, verify each bit is isolated (shift left then right, or mask) before comparison; shifting the whole word lets neighboring set bits corrupt the check and turns ordering assumptions into a DoS.