#vulnerable code 
                                @Override
    @DbSession
    public void onRollback(StopAgentTransaction tx) {
        Transaction joinTx = ledgerService.getTx(tx.getTxData());
        if (joinTx.getType() == TransactionConstant.TX_TYPE_REGISTER_AGENT) {
            RegisterAgentTransaction raTx = (RegisterAgentTransaction) joinTx;
            Consensus<Agent> ca = raTx.getTxData();
            ca.getExtend().setBlockHeight(raTx.getBlockHeight());
            ca.getExtend().setStatus(ConsensusStatusEnum.WAITING.getCode());
            AgentPo agentPo = ConsensusTool.agentToPojo(ca);
            agentPo.setBlockHeight(joinTx.getBlockHeight());
            agentPo.setDelHeight(0L);
            this.agentDataService.updateSelective(agentPo);

//            this.ledgerService.unlockTxRollback(tx.getTxData().getDigestHex());

            UpdateDepositByAgentIdParam dpo = new UpdateDepositByAgentIdParam();
            dpo.setAgentId(ca.getHexHash());
            dpo.setOldDelHeight(joinTx.getBlockHeight());
            dpo.setNewDelHeight(0L);
            this.depositDataService.updateSelectiveByAgentHash(dpo);

            //cache deposit
            Map<String, Object> params = new HashMap<>();
            params.put("agentHash", raTx.getTxData().getHexHash());
            List<DepositPo> polist = this.depositDataService.getList(params);
            if (null != polist) {
                for (DepositPo po : polist) {
                    Consensus<Deposit> cd = ConsensusTool.fromPojo(po);
                    this.ledgerService.unlockTxRollback(po.getTxHash());
                }
            }

//todo            CancelConsensusNotice notice = new CancelConsensusNotice();
//            notice.setEventBody(tx);
//            NulsContext.getServiceBean(EventBroadcaster.class).publishToLocal(notice);

            Consensus<Agent> agent = manager.getAgentById(ca.getHexHash());
            agent.setDelHeight(0L);
            manager.putAgent(agent);

            List<Consensus<Deposit>> depositList = manager.getAllDepositList();
            for(Consensus<Deposit> depositConsensus:depositList){
                if(!depositConsensus.getExtend().getAgentHash().equals(agent.getHexHash())){
                    continue;
                }
                if(depositConsensus.getExtend().getBlockHeight()>joinTx.getBlockHeight()){
                    continue;
                }
                if(depositConsensus.getDelHeight()<tx.getBlockHeight()){
                    continue;
                }
                depositConsensus.setDelHeight(0L);
                manager.putDeposit(depositConsensus);
            }
            return;
        }
        PocJoinConsensusTransaction pjcTx = (PocJoinConsensusTransaction) joinTx;
        Consensus<Deposit> cd = pjcTx.getTxData();
        cd.getExtend().setStatus(ConsensusStatusEnum.IN.getCode());
        DepositPo dpo = new DepositPo();
        dpo.setId(cd.getHexHash());
        dpo.setDelHeight(0L);
        this.depositDataService.updateSelective(dpo);
        StopConsensusNotice notice = new StopConsensusNotice();
        notice.setEventBody(tx);
        NulsContext.getServiceBean(EventBroadcaster.class).publishToLocal(notice);
        this.ledgerService.unlockTxRollback(tx.getTxData().getDigestHex());

        Consensus<Deposit> depositConsensus = manager.getDepositById(cd.getHexHash());
        depositConsensus.setDelHeight(0L);
        manager.putDeposit(depositConsensus);
    } 
                            #location 67 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Override
    @DbSession
    public void onRollback(StopAgentTransaction tx) {
        Transaction joinTx = ledgerService.getTx(tx.getTxData());
        RegisterAgentTransaction raTx = (RegisterAgentTransaction) joinTx;
        Consensus<Agent> ca = raTx.getTxData();
        ca.getExtend().setBlockHeight(raTx.getBlockHeight());
        ca.getExtend().setStatus(ConsensusStatusEnum.WAITING.getCode());
        AgentPo agentPo = ConsensusTool.agentToPojo(ca);
        agentPo.setBlockHeight(joinTx.getBlockHeight());
        agentPo.setDelHeight(0L);
        this.agentDataService.updateSelective(agentPo);

//            this.ledgerService.unlockTxRollback(tx.getTxData().getDigestHex());

        UpdateDepositByAgentIdParam dpo = new UpdateDepositByAgentIdParam();
        dpo.setAgentId(ca.getHexHash());
        dpo.setOldDelHeight(joinTx.getBlockHeight());
        dpo.setNewDelHeight(0L);
        this.depositDataService.updateSelectiveByAgentHash(dpo);

        //cache deposit
        Map<String, Object> params = new HashMap<>();
        params.put("agentHash", raTx.getTxData().getHexHash());
        List<DepositPo> polist = this.depositDataService.getList(params);
        if (null != polist) {
            for (DepositPo po : polist) {
                Consensus<Deposit> cd = ConsensusTool.fromPojo(po);
                this.ledgerService.unlockTxRollback(po.getTxHash());
            }
        }

//todo            CancelConsensusNotice notice = new CancelConsensusNotice();
//            notice.setEventBody(tx);
//            NulsContext.getServiceBean(EventBroadcaster.class).publishToLocal(notice);

        Consensus<Agent> agent = manager.getAgentById(ca.getHexHash());
        agent.setDelHeight(0L);
        manager.putAgent(agent);

        List<Consensus<Deposit>> depositList = manager.getAllDepositList();
        for (Consensus<Deposit> depositConsensus : depositList) {
            if (!depositConsensus.getExtend().getAgentHash().equals(agent.getHexHash())) {
                continue;
            }
            if (depositConsensus.getExtend().getBlockHeight() > joinTx.getBlockHeight()) {
                continue;
            }
            if (depositConsensus.getDelHeight() < tx.getBlockHeight()) {
                continue;
            }
            depositConsensus.setDelHeight(0L);
            manager.putDeposit(depositConsensus);
        }

    }