F-2025-0006·unchecked-return-value

Missing return value check for EnumerableSet .add() and .remove() operations

Acknowledgednftstakingeip-712
TL;DR

EnumerableSet .add() and .remove() return a bool indicating success, but the contract ignores the result. Failed operations could lead to inconsistent state assumptions.

Severity
LOW
Impact
LOW
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

In the GenesisLicenseStaking.sol contract, the EnumerableSet utility functions .add() and .remove() from OpenZeppelin's library are used in multiple places to manage sets (for example, of stakers, token IDs, pools).

However, these functions return a bool indicating whether the operation succeeded:

  • .add() returns false if the element was already present.
  • .remove() returns false if the element was not in the set.

These return values are currently not checked, meaning:

  • A failed .add() might falsely imply a new addition.
  • A failed .remove() could lead to assumptions that the element was deleted when it wasn't.

This could result in inconsistent state assumptions, misleading bookkeeping, and incorrect logic execution downstream.

03Section · Impact

Impact

Subtle accounting errors are possible. For example, attempting to remove an index that is not in the queue will silently succeed without removing anything, leaving downstream state inconsistent.

04Section · Recommendation

Recommendation

Update all calls to .add() and .remove() to check their return value, and explicitly revert() on failure if the logic depends on the success of the operation.

F-2025-0006

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx