# Shared balance multi-class pricing

Do pricing getters read one raw token balance shared across classes, buckets, or maturities?

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2026-09-05. Updated 2026-10-25._

## How it works

A contract offers several share classes, buckets, or maturities but keeps only one raw token balance. Each class's price or entitlement is computed from that same shared balance instead of from per-class accounting. The assumption that breaks is "the balance I read belongs to this class." It does not: it belongs to all of them. Any class can then be priced against value it does not own, and the error compounds when a new class is added or a claim is settled.

## Where it shows up

- Pricing getters (`getTotalAssetBalance`, `getRemainingBalance`, exchange-rate math) that call `balanceOf(address(this))` or a provider leg's raw balance with no per-class ledger [E1](https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md).
- Permissionless registration of new assets or classes that then share an existing raw balance [E1](https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md).
- Per-pool `remaining`/reward fields read against a shared token `balanceOf` rather than a before/after delta around the claim [E2](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-06.md).
- Maturity pools where a fee is credited to `unassignedEarnings` but the removal path never flushes it [E3](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md).
- Guard conditions that compare against a field already zeroed by deletion [E3](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md).

## How to review

For every price or entitlement getter, trace the balance it reads back to the class being priced. The invariant: each class's value derives only from assets attributed to that class, and the sum of class values never exceeds the contract's real holdings. Check that adding a class cannot re-point an existing balance. For rewards and fees, require earned amounts to come from balance deltas around the claim call, not from a stored `remaining` compared to a shared balance [E2](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-06.md). For settlement paths, confirm every variable credited with a fee is also cleared on the path that removes the debt [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md), and that guards still hold after state deletion [E3](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md).

## Variants seen

- New share class registered permissionlessly, priced off an existing raw balance, inflating one class's price [E1](https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md).
- Shared reward token across pools with per-pool `remaining` corrupting accounting [E2](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-06.md).
- Unassigned earnings stranded when the repaid maturity is not the last, claimable by anyone [E3](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md).
- Bad-debt clearing deducts from the accumulator but leaves pool `unassignedEarnings` untracked [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md).

## Why fixes fail

E3 is a regression of an earlier issue where only a partial fix was applied: the guard compares against `position.principal`, which deletion zeroes, so it only works in the terminal case and leaves value stranded in intermediate states.

## Impact and severity

E1 drained ~9.25 ETH via flash loan; E2 froze undistributed rewards and reverted deposits/withdrawals; E3/E4 left funds claimable by anyone or untracked. Severity rises with permissionless entry points and shared balances across many classes.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-06.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md