# Fixed: Cadence Vulnerability 2021-04-13 **URL:** \ **Category:** Security Notifications\ **Created:** [May 14, 2021, 8:56pm UTC](https://forum.flow.com/t/fixed-cadence-vulnerability-2021-04-13/1926 "2021-05-14T20:56:28Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![DrewGarrison](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/drewgarrison/32/438_2.png) [@DrewGarrison](https://forum.flow.com/u/DrewGarrison)\ **Post date:** [May 14, 2021, 8:56pm UTC](https://forum.flow.com/t/fixed-cadence-vulnerability-2021-04-13/1926/1 "2021-05-14T20:56:28Z")
### Issue Overview - **Current Status: Issue Fixed** - **Affected Network: Testnet, Mainnet** ### Summary of Impact The vulnerability could have allowed someone to send a malicious transaction that would have allowed them to duplicate resources. ## Technical Summary of Issue - Function post-conditions may use the special variable `result`, which is the value that is returned from the function - If the function return type is a resource type, the `result` variable represents a second location for the resource to exist in, which should be invalid - This is a language design issue, the interaction of resource semantics and post-conditions was not considered ### Addressing the Issue **Hot Fix** When the return type of a function is a resource type, then declare the type of the special variable `result` to be a reference type. ### Recognition As core contributors to the Flow ecosystem, we take reported issues very seriously and would like to thank Deniz Mert Edincik for finding and reporting this issue responsibly through our [Responsible Disclosure Policy](https://github.com/onflow/flow/blob/master/SECURITY.md). ### Timeline **2021-04-13** - Issue reported **2021-04-15** - Issue investigated - Minimal reproduction created - Fix implemented - Analyzed impact on Mainnet contracts - Fix tested locally - Testnet updated and tested - Mainnet update started **2021-04-16** - Mainnet update complete and tested **2021-05-14** - Public disclosure