# Batch and epoch ID collisions

IDs reused or overlapping across records, so one record settles or overwrites another's balance

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-06-27. Updated 2026-10-25._

## How it works
A protocol keys its bookkeeping by an identifier it does not fully control or does not make unique. Two records end up sharing a key: a batch range that overlaps, an order hash that repeats across partial fills, a mapping slot keyed only by an NFT index, or an order ID derived from block number and user alone. When one record is written, settled, or deleted, it acts on the other record's balance. The broken assumption is that the identifier is unique per record; in reality the external system or the ID generator reuses it.

## Where it shows up
- A request ID encodes a range of external IDs, and finalize reads live balances over that whole range [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-3.md).
- Internal hash derived from an external order omits a nonce or per-fill amount [E2](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-07.md).
- A mapping keyed by a shared identifier (NFT index, order ID) written without an existing-entry guard [E3](https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AH-02.md).
- ID generator hashes only block-scoped values and user, with no contract address or nonce [E4](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md).
- Finalize/cancel loops that redeem or refund the full balance per ID rather than a stored per-request amount [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-3.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md).

## How to review
For every identifier used as a storage key or settlement key, ask: can two distinct records produce the same key? Check that the ID includes contract address and a per-user nonce [E4](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md), that hashes of external orders include fill-specific data [E2](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-07.md), and that writes to shared-key mappings guard against an existing entry [E3](https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AH-02.md). For range-based IDs, confirm finalize settles a stored per-request amount, not the live balance over the range [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-3.md). The invariant: each record's key maps to exactly one record, and settlement touches only that record's stored amount.

## Variants seen
- Overlapping batch-ID ranges redeem another user's withdrawal [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-3.md).
- Partial fills collide on rental order hash, locking residual assets [E2](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-07.md).
- Shared NFT-index key overwrites prior lock position [E3](https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AH-02.md).
- Cross-contract order ID collision enables double refund on cancel [E4](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md).

## Impact and severity
Led to theft of owed tokens [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-3.md), locked lender NFTs and ERC20 [E2](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-07.md), permanent loss of locked funds [E3](https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AH-02.md), and fund theft via double refund [E4](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md). Severity is high: losses are direct and often permanent. Worse when settlement reads live balances over a range [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-3.md) or when cancel/refund paths can be repeated [E4](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-3.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-07.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AH-02.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-7.md