# Shared liquidity counted as sole ownership

Position value or emptiness derived from pool-wide or partial balances instead of the position's own share

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-02-17. Updated 2026-10-25._

## How it works
A contract needs to know how much a position is worth, or whether it still holds anything. Instead of reading the position's own record, it reads a pool-wide or partial total: pool liquidity at a tick range, pool USD balance, or a subset of venue balances. That total includes liquidity the contract does not own, or omits liquidity it does own. The assumption that breaks is "the number I read belongs to me." In Uniswap/Solidly V3, liquidity at a tick is shared by every LP in that range, and total liquidity spans many ranges, so it is not proportional to reserves or to any single position [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-axion%3AH-4.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-20.md).

## Where it shows up
- Value or share computed as `amount * poolTotal / poolBalance` or similar ratio against pool-wide totals [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-axion%3AH-4.md)
- `pool.positions(keccak(positionManager, tickLower, tickUpper))` used as the position's liquidity, without resolving the specific tokenId [E2](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-20.md)
- "Is empty" or "is closed" predicates that check only some balances (e.g. SY/PT/YT and LP on the connector) and ignore staked or deposited balances elsewhere [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-21.md)
- Any TVL or share figure derived from `liquidity()`, `balanceOf(pool)`, or aggregated tick data rather than per-position state

## How to review
Identify the exact quantity the code claims to own, then check the source it reads. The invariant: the value attributed to a position must come from state keyed to that position (its tokenId via the position manager, its own staked balance), and must equal the sum over every venue where its assets sit. For V3-style pools, confirm the code uses per-tokenId `positions()` or tick-range sqrt-price math, never pool-wide liquidity or USD balance. For emptiness checks, confirm every venue holding the position's assets is included. Ask whether an outsider can mint or deposit to change the denominator [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-axion%3AH-4.md).

## Variants seen
- Ratio against pool USD balance, skewable by an attacker's unbalanced LP position, causing DoS [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-axion%3AH-4.md)
- Tick-keyed `pool.positions` lookup counting all LPs' liquidity as the connector's, inflating TVL [E2](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-20.md)
- Emptiness predicate omitting a staked venue, deleting a position that still holds stake and understating TVL [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-21.md)

## Impact and severity
Inflated TVL [E2](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-20.md), understated TVL [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-21.md), and denial of service on liquidity/farm functions [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-axion%3AH-4.md). Severity is high where the wrong number feeds share pricing, minting, or position lifecycle; worse when an attacker can move the denominator at will [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-axion%3AH-4.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-10-axion%3AH-4.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-20.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-21.md