# Cancel path skips refund or restore

Terminal paths (cancel, expire, abort) that delete escrow state without refunding or restoring balances

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2024-12-04. Updated 2026-10-24._

## How it works
A contract escrows user funds or records a deposit, then a terminal transition (cancel, expiry, abort) deletes or overwrites that state. The assumption that breaks: that cleanup of state and return of funds are the same action. They are separate code paths, and the terminal path can run without the refund. The escrowed value is then stranded or misdirected, and the contract's recorded balances drift from what users actually hold.

## Where it shows up
- A `cancel`/`expire`/`abort` function that deletes a params/order struct and emits an event but has no loop or transfer returning escrowed tokens [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-10.md).
- Refund logic that reads a mutable config field (denom, price, asset id) at cancel time instead of the value recorded at deposit time [E1](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-06.md).
- Setters that can mutate that field while funds are still escrowed, with no active-bid/active-escrow guard [E1](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-06.md).
- Cancel paths that pay out an asset only guaranteed to exist on another chain or context [E3](https://bugbountylibrary.com/r/c4%3A2021-07-connext%3AH-04.md).
- Any stateful process with a vote/deposit step and a separate teardown step.

## How to review
For every state that holds user value, enumerate all terminal transitions and confirm each has a matching unwind. The invariant: for each escrowed position, sum of refunds on every exit path equals the amount recorded at deposit time, using the deposit-time values, not current config. Check that setters touching refund-relevant fields are blocked while escrow is active, and that every asset referenced in a payout is guaranteed present in that execution context.

## Variants seen
- Mutable denom read at refund time, letting seller drain contract funds via a higher-value denom [E1](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-06.md).
- Cancel deletes shutdown params without iterating voters to refund escrowed tokens [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-10.md).
- Cancel pays relayer in destination asset on the sending chain, so cancel reverts and funds lock [E3](https://bugbountylibrary.com/r/c4%3A2021-07-connext%3AH-04.md).

## Impact and severity
Loss of user funds: permanent token loss [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-10.md), theft of other users' funds [E1](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-06.md), and permanently locked funds on expiry [E3](https://bugbountylibrary.com/r/c4%3A2021-07-connext%3AH-04.md). Severity is high because the loss is silent and irreversible; it worsens when the terminal path is the only recovery route, so a reverting or missing refund leaves no fallback.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-06.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-10.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-07-connext%3AH-04.md