# Penalty applied to wrong base

Penalty or slash computed on full balance or gross amount instead of only the eligible portion

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-05-23. Updated 2026-10-25._

## How it works
A contract intends to penalize only part of a balance (the non-vested, ineligible, or early-exit portion) but computes the penalty on a larger base: the whole unclaimed amount, the whole epoch pool, or a flat rate that ignores a user-chosen parameter. The assumption that breaks is that the penalty base equals the eligible base. When the two diverge, users are overcharged, or the penalty becomes cheaper than the reward it was meant to offset.

## Where it shows up
- A function that caches `amount - claimed` (full unclaimed) and multiplies by a penalty percentage, while a separate view already computes the penalty-free vested portion.
- Slash/burn paths that consume a whole epoch or bucket without subtracting the time-vested fraction that `totalAssets()` treats as available.
- A flat penalty percentage set at initialization, paired with a reward weight that scales with a user-chosen lock duration.
- Two code paths to the same outcome (partial claim vs early claim) whose accounting differs.

## How to review
Identify the eligible base for each penalty and confirm the code computes it explicitly rather than reusing a gross balance. The invariant: penalty base == eligible (non-vested / non-eligible) amount, and any vested or already-available portion is excluded. For slashing, diff the vesting view against the burn path: the burned amount must equal the pool minus the vested fraction. For flat penalties, check whether the penalized parameter also drives rewards; if so, the penalty must scale with it or the exit must be gated.

## Variants seen
- Early-claim penalty on full unclaimed balance instead of non-vested portion [E1](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.9.md).
- Slash of entire current-epoch reward pool including already-vested rewards [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.4.md).
- Static penalty independent of lock duration while reward weight scales up to ~16x [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-15.md).

## Impact and severity
Overcharging users on early claims [E1](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.9.md), over-slashing vested rewards [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.4.md), and enabling reward farming followed by cheap exit [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-15.md). Severity rises when the mismatch is systematic (every user) and when the penalized parameter is user-controlled, letting attackers maximize the gap.

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.9.md
- E2: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.4.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-15.md