# Stale internal balance tracker divergence

Math uses a stored balance or timestamp while the real balance or record moved elsewhere

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-07-07. Updated 2026-10-24._

## How it works
A contract keeps its own copy of a quantity (staked amount, buffer, per-record timestamp) and does math on that copy. The real quantity changes through another path — rewards accrue, slashing hits, tokens move into an LP, a cancel reverses user state — and the copy is not updated. The assumption that breaks is "the stored value equals reality at the moment we use it." Every later calculation inherits the gap.

## Where it shows up
- A stored `amount`, `buffer`, `locked`, or `lastUpdated` field read in math, with no refresh from the source of truth before use.
- Functions that move tokens out (LP provision, transfers, redelegation) without a `getAvailableBalance`-style guard [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AH-1.md).
- Accumulators that add `(now - lastUpdated) * value` where an early `continue`/`return` can skip the timestamp write [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AH-2.md).
- Cancel/reverse paths that decrement user-facing state but not the internal accounting variable [E3](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md).
- Cached delegation amounts used to build messages, while rewards and slashing drift the real delegation [E4](https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AM-06.md).

## How to review
For each stored tracker, find every writer and every reader. The invariant: before any math or outbound transfer, the tracker must equal the real balance, or the code must query the source of truth. Check that every early-exit path between accumulation and the timestamp/state write still performs the write [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AH-2.md). Check that every token-moving function is gated by the same availability check as the unstake path [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AH-1.md). Check that cancel and reverse paths symmetrically restore the accounting variable [E3](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md). Check that full-position moves read live state, not a cache [E4](https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AM-06.md).

## Variants seen
- Saturated record skips its timestamp refresh, inflating an accumulator [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AH-2.md).
- Staked balance tracked separately from custody; LP path bypasses the guard [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AH-1.md).
- Buffer decremented on withdrawal, never restored on cancel [E3](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md).
- Cached delegation amount drifts from real delegation via rewards/slashing [E4](https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AM-06.md).

## Impact and severity
Rewards drained beyond the cap [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AH-2.md), tax-free exit of staked tokens while rewards keep accruing [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AH-1.md), unbacked funds sent to L1 and HYPE locked [E3](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md), failed redelegation or orphaned funds [E4](https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AM-06.md). High severity: the drift is silent, repeatable, and grows with time or reward accrual, so it worsens the longer it goes unnoticed.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AH-2.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AH-1.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AM-06.md