# Positional index mismatch across arrays

Loops or helpers pairing i with i+1, or positional arrays against a list that mutates on removal

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2023-08-09. Updated 2026-10-23._

## How it works
Code assumes two things stay aligned: an index into one array or list, and the value or helper it is paired with. The assumption breaks when the pairing is off by one, or when the list's order changes (swap-and-pop removal, additions) while a stored or user-supplied positional array is still interpreted against the old order. The result is that a value meant for element N is applied to element N-1 or to a different token entirely, and bookkeeping silently drifts from reality.

## Where it shows up
- A loop that reads storage with `i+1` but passes `i` to a helper, or vice versa [E2](https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AH-05.md).
- Length assertions guarding an assembly loop, where the bound has a `+1` slack [E1](https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AM-02.md).
- User-supplied arrays (slippage limits, min-outs) mapped positionally onto an on-chain list [E3](https://bugbountylibrary.com/r/c4%3A2023-06-angle%3AM-07.md).
- Any removal path using swap-and-pop that reorders a list later indexed positionally [E3](https://bugbountylibrary.com/r/c4%3A2023-06-angle%3AM-07.md).
- Sibling functions sharing a helper with different index conventions.

## How to review
For each index used, confirm the exact element it refers to in every array it touches. The invariant: for all i, the index passed to a helper and the index used to read storage must denote the same logical element. Check every mutation path (add, remove, swap-and-pop) for whether positional arrays keyed by index remain valid afterward. For assembly loops, verify the bound equals the true element count with no slack [E1](https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AM-02.md). Cross-check all callers of a shared helper for consistent index pairing [E2](https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AH-05.md).

## Variants seen
- Off-by-one in a length assertion letting an assembly loop read out of bounds [E1](https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AM-02.md).
- Tier index `i` passed where `i+1` was intended, skewing redemption weight [E2](https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AH-05.md).
- Swap-and-pop reordering a collateral list so a positional slippage array applies to wrong tokens [E3](https://bugbountylibrary.com/r/c4%3A2023-06-angle%3AM-07.md).

## Impact and severity
Wrong payout amounts to redeemers [E2](https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AH-05.md), skipped consideration items in order fulfillment [E1](https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AM-02.md), and slippage limits silently applied to the wrong tokens [E3](https://bugbountylibrary.com/r/c4%3A2023-06-angle%3AM-07.md). Severity rises when the mismatch is reachable by an untrusted caller or triggered by routine admin actions like revoking collateral, and when the drift is silent so users cannot detect it before funds move.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-05-opensea-seaport%3AM-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AH-05.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-06-angle%3AM-07.md