# Shared record missing type or owner check

One record reused for several types or owners; lookup checks only part of the key

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-12-04. Updated 2026-10-25._

## How it works
A single storage record (or collection) is reused for more than one kind of thing: long and short positions, short- and long-term rentals. The code assumes the record's identity is enough to know what it is, so lookups and guards check only part of the key or only one field. When two different things collapse onto the same record, a check that is correct for one shape silently passes for the other, and bookkeeping (liquidity, denom, balances) is updated against the wrong meaning.

## Where it shows up
- A struct carries a type/discriminator flag that no function ever reads.
- Lookup by attributes (address + period, position key) that omits the type or owner.
- A transfer or edit guard comparing only one half of a packed slot (e.g. right slot) while the other half can be nonzero.
- A payout function reading denom or price from mutable state set by a weakly guarded setter.

## How to review
For every shared record, list all the distinct things it can represent and confirm each read path either checks the discriminator/owner or is provably type-independent. The invariant: any function that mutates or pays out based on a record must verify the record's full identity before acting — the type/owner discriminator, and every packed field that can be nonzero for the same key. For a packed slot, the guard must compare the whole slot (both left and right halves), not just the net side. Grep every read of a type flag; if it is never read, the guard is missing. For setters, check the guard accounts for unsettled obligations, not just time.

## Variants seen
- Packed position slot: guard checks only net (right-slot) liquidity, left slot ignored, so partial transfer corrupts shared storage [E1](https://bugbountylibrary.com/r/c4%3A2023-11-panoptic%3AH-02.md).
- Rental type flag stored but never validated; cancel function matches any rental and refunds in the wrong denom [E2](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-04.md).
- Edit guard checks only checkout time, letting denom be swapped before finalization payout [E3](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-07.md).

## Impact and severity
Led to corrupted premium accounting [E1](https://bugbountylibrary.com/r/c4%3A2023-11-panoptic%3AH-02.md), refunds in the wrong (more valuable) denom [E2](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-04.md), and theft of pooled deposits [E3](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-07.md). Severity is high: the flaw is silent, affects funds directly, and worsens when records are shared across users or when payouts read mutable config.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-11-panoptic%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-04.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-07.md