# Requested amount instead of measured output

Does the code size repay, swap, or payout from the requested input rather than the measured output delta?

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-02-17. Updated 2026-10-25._

## How it works
A function needs to know how much was actually repaid, swapped, or withdrawn. Instead of measuring the real change (balance delta, swap return value, remaining principal), it reuses a number it already has: the user-requested amount, the original principal, or the recipient's full balance. That number is not the same as the amount that moved, so every downstream counter, debt balance, or payout is sized wrong. The broken assumption is that "the amount I asked for" equals "the amount that actually moved."

## Where it shows up
- A repay/swap helper whose return value is ignored while a user-supplied `amount` is used instead [E2](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-02.md)
- "Amount owed" read from a loan summary that stores original principal, while repayments are tracked separately [E1](https://bugbountylibrary.com/r/sherlock%3A2024-11-teller-finance-update%3AH-3.md)
- A helper returning `balanceOf(recipient)` rather than the before/after difference [E3](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-08.md)
- Parallel paths (deposit vs repay, add vs remove) that consume a shared swap helper differently [E2](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-02.md)
- Accounting counters (`totalRepaid`, `withdrawnCollateral`) fed from these values

## How to review
For each value that feeds accounting, trace where it comes from and confirm it is the measured delta, not the request. The invariant: any amount credited, repaid, or paid out must equal the observed change in the relevant balance or the remaining obligation, never the requested input or a full balance. Concretely:
- Does the code use the swap/transfer return value, or the user's `amount`? [E2](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-02.md)
- Does "owed" mean remaining principal or original principal? [E1](https://bugbountylibrary.com/r/sherlock%3A2024-11-teller-finance-update%3AH-3.md)
- Is a returned "received" amount a delta, or a raw `balanceOf`? [E3](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-08.md)
- Diff parallel paths sharing a helper; the asymmetric one is suspect [E2](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-02.md)

## Variants seen
- Repay sized from user input, ignoring swap output, so swapped tokens are drained without reducing debt [E2](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-02.md)
- Liquidation "amount due" taken from original principal, double-counting already-repaid principal [E1](https://bugbountylibrary.com/r/sherlock%3A2024-11-teller-finance-update%3AH-3.md)
- Exit amount returned as recipient's full balance, inflating withdrawn collateral and reverting on transfer-exceeds-balance [E3](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-08.md)

## Impact and severity
Led to lost user funds, corrupted pool accounting, and broken leverage-down flows [E1](https://bugbountylibrary.com/r/sherlock%3A2024-11-teller-finance-update%3AH-3.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-02.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-08.md). Severity rises when the wrong value feeds shared counters or liquidation math, since one bad number propagates across users and positions.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-11-teller-finance-update%3AH-3.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-02.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-08.md