# Self-reserve refund nets fee to zero

Payer also receives the refund or reserve, so a fee or debt nets to zero

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2026-10-02. Updated 2026-10-25._

## How it works
A path charges a cost (fee, burn, debt) and a separate path returns value (refund, reserve, keeper reward, burn credit) to the same actor. If the return is not isolated from the charge, the two cancel and the intended cost disappears. The broken assumption is that the payer and the refund recipient are different parties, or that the credit is settled in its own context. When one actor can be both, the net is zero and the protocol loses the fee or the asset.

## Where it shows up
- A burn, liquidation, or claim that pays a reward or refund back to the caller who triggered it.
- Shared transaction context where a credit is netted against unrelated open deltas (e.g. `modifyLiquiditiesWithoutUnlock` inside an already-open unlock) [E1](https://bugbountylibrary.com/r/dhl%3A20261002-goldpesa.md).
- Keeper reward equal to collateral burned, letting reserver and liquidator be the same address [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-15.md).
- Burn or deposit path returning a paired asset at a fixed ratio decoupled from the pool exchange rate [E3](https://bugbountylibrary.com/r/dhl%3A20250716-vds.md).
- Any permissionless entry point that lets an outsider park an offsetting delta before the protocol's own operation runs [E1](https://bugbountylibrary.com/r/dhl%3A20261002-goldpesa.md).

## How to review
Identify every path where value leaves the protocol to the same address that paid in. For each, check the invariant: the net cost to the actor must equal the intended fee, and the protocol's credit must be settled in isolation from other open deltas. Concretely: does the burn/mint verify its own deltas are zero before acting [E1](https://bugbountylibrary.com/r/dhl%3A20261002-goldpesa.md)? Can the reserver also be the liquidator [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-15.md)? Does the return ratio track the deposit exchange rate [E3](https://bugbountylibrary.com/r/dhl%3A20250716-vds.md)? If any answer is no, the fee can be dodged.

## Variants seen
- Shared-unlock delta netting frees mint debt [E1](https://bugbountylibrary.com/r/dhl%3A20261002-goldpesa.md).
- Reserve-then-liquidate self-cycle refunds the fee [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-15.md).
- Burn-to-contract returns paired asset 1:1, enabling round-trip [E3](https://bugbountylibrary.com/r/dhl%3A20250716-vds.md).

## Impact and severity
Losses ranged from dodged listing fees [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-15.md) to a 114,999 USDC drain [E1](https://bugbountylibrary.com/r/dhl%3A20261002-goldpesa.md) and a flash-loanable full drain [E3](https://bugbountylibrary.com/r/dhl%3A20250716-vds.md). Severity rises when the netting is permissionless and repeatable, and when a flash loan supplies the capital to scale the round trip.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20261002-goldpesa.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AM-15.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250716-vds.md