# Stale order state after cancel or fill

Order status and backing not re-checked by matching, refund or debt paths

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-08-13. Updated 2026-10-24._

## How it works
An order's lifecycle status and its pointer/amount fields are stored separately. Code that validates an order checks the pointer (owner, shortRecordId, tokenId, lot amount) but not whether the order is still live. When an order is cancelled, partially filled, or its backing balance drops, the pointer or stored remainder survives and still satisfies the checks. A later path then acts on a record that no longer matches reality: exiting debt against a cancelled order, filling an auction whose lot was drained, or taking tokens against zero liability.

## Where it shows up
- Validation functions that read `order.owner`/`order.shortRecordId`/`tokenId->id` but never `order.cancelled`/`status`/`filled`.
- Create/list paths that write an id into a `tokenId->id` mapping without reverting if one already exists.
- Creation-time caps (`min(balance, lot)`) protecting a later fill, where the balance can be withdrawn between create and fill [E2](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-03.md).
- Partial-fill branches that store `remaining_*` while separately mutating or defaulting the underlying liability.
- Auctions/orders with no cancel or removal path that block new ones [E2](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-03.md).
- Dust thresholds (e.g. DUST_FACTOR) leaving sub-threshold remainders that survive matching [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AM-06.md).

## How to review
For every order/auction, identify the invariant: any stored order referenced by a matching, refund or debt path must have live backing equal to its stored amount. Check each mutation (cancel, partial fill, withdraw, default) updates both the status/pointer and the amount, and that every consumer re-checks status, not just pointers. For creation-time caps, confirm the capped resource cannot be drained before fill, or that a cancel path exists. For id mappings, confirm re-invocation reverts or overwrites cleanly with old escrow released.

## Variants seen
- Cancelled ShortOrder still referenced to exit a ShortRecord, leaving dust short order [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AM-06.md).
- Backstop withdrawal after bad-debt auction creation drains lot, auction unfillable and blocks future auctions [E2](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-03.md).
- Duplicate auction creation overwrites tokenId->id mapping, orphaning escrowed bidder funds [E3](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AH-01.md).
- Partial fill defaults liability but persists remaining auction, later filler takes tokens with zero debt [E4](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-09.md).

## Why fixes fail
Adding a status check only at one consumer leaves other paths (refund, liquidation) reading the stale pointer. Capping at creation without a cancel path turns a transient shortfall into a permanent block [E2](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-03.md).

## Impact and severity
Medium to high: locked bidder funds [E3](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AH-01.md), unfillable auctions blocking liquidation [E2](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-03.md), free token extraction against zero debt [E4](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-09.md), and gas-bloating dust that deters liquidators [E1](https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AM-06.md). Severity rises when no cancel path exists or funds are permanently escrowed.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-03-dittoeth%3AM-06.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AH-01.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-09.md