# Epoch settlement guard bypass in claims

Claim pays before epoch/batch settles, or boundary operators disagree, letting payouts hit unsettled state

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-03-04. Updated 2026-10-25._

## How it works
Epoch- and batch-based systems separate *requesting* value from *settling* it. The invariant: a claim pays only against settled state, and settlement status plus the epoch counter advance together. Bugs appear when the claim path trusts a conversion or status check valid only for settled epochs, or when two functions disagree on the exact boundary where settlement becomes legal. The payout then computes against unsettled (often zero) state, or fires twice.

## Where it shows up
- Claim/withdraw functions calling preview/convert helpers without first asserting the request's epoch is settled [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-amphor%3AH-1.md).
- Preview/conversion helpers returning zero for the current (unsettled) epoch while claim still clears the request balance [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-amphor%3AH-1.md).
- Claim-on-behalf-of-others entry points that combine claim with a new request [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-amphor%3AH-1.md).
- Settlement functions that mark an epoch settled without incrementing the epoch counter [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-1.md).
- One-time-per-epoch guards on queueing, paired with late requests landing in an already-settled epoch [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-1.md).
- Time-window guards using different comparison operators (`<`, `>`, `<=`) for the same period across functions [E3](https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-4.md).
- Migration/upgrade checks gated on `batch < firstPostUpgradeBatch`, leaving the upgrade batch itself unchecked [E4].

## How to review
For every claim/withdraw path, trace the exact condition proving the epoch/batch is settled, and confirm it is checked *before* any balance is cleared or value transferred. Verify the epoch counter advances at settlement initiation, not only at completion, so new requests cannot be stranded [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-1.md). Diff every comparison operator across functions sharing a time window; the boundary timestamp must be treated identically everywhere [E3](https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-4.md). For upgrades, confirm legacy-status checks cover the upgrade batch itself, not just earlier batches [E4]. Property: a claim pays at most once, only against settled state, and settlement status plus counter move atomically.

## Variants seen
- Missing settlement check on claim; zero-share claim wipes others' deposit requests [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-amphor%3AH-1.md).
- Settlement without counter increment, stranding late requests in the settled epoch [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-1.md).
- Off-by-one boundary mismatch between settle and clearable checks at exactly kickTime+72h [E3](https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-4.md).
- Upgrade-batch boundary bypass enabling double withdrawal [E4].

## Why fixes fail
Guarding only pre-upgrade batches leaves the upgrade batch open [E4]; fixing one comparison operator without aligning the others leaves the boundary exploitable [E3](https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-4.md).

## Impact and severity
Zero-value claims that erase other users' deposit requests [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-amphor%3AH-1.md); funds locked and rebalance blocked [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-1.md); bad debt shifted onto other Ajna HPB depositors via the exact-boundary settlement [E3](https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-4.md); double withdrawal of bridged assets [E4]. Severity is high where claims are permissionless or on-behalf-of, and where the boundary timestamp is exactly reachable.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-03-amphor%3AH-1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-4.md