# Token direction and ordering bugs

Token direction or index taken from assumption or caller input instead of pool state

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-06-27. Updated 2026-10-25._

## How it works
Code decides which token moves, which amount field means what, or which return value is the output, using an assumption (a fixed token order, a caller-supplied type, a remembered array index) rather than the actual pool or call result. The assumption is usually true in the common case, so tests pass; when it is false the contract moves or credits the wrong asset or quantity.

## Where it shows up
- Refund or payout transfers that name a token variable rather than the one actually paid in [E1](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-08.md)
- Trade type or amount semantics read from caller-supplied params where the function's own comment states a fixed intent [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-10.md)
- AMM router return arrays indexed at [0] instead of [1] for the output amount [E3](https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-03.md)
- Direction flags derived from token identity (e.g. "is WETH") instead of reading token0()/token1() [E4](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AH-03.md)
- Any hardcoded token ordering where the venue orders lexicographically by address [E4](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AH-03.md)

## How to review
For each transfer, swap, mint or refund, trace the token and amount back to their source. The invariant: the asset and quantity moved must be derived from observed state (pool token0/token1, actual swap return, the token the caller paid) and must match the function's stated intent. Check that caller-supplied type or amount fields cannot reinterpret the amount (EXACT_IN vs EXACT_OUT). Confirm return-array indices against the router's documented output positions. Confirm direction flags compare against pool ordering, not token identity.

## Variants seen
- Wrong token refunded after swap, draining router-held balances [E1](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-08.md)
- Caller flips trade type, turning a sell into an over-buy with vault funds [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-10.md)
- Wrong return index mints incorrect receipt amounts [E3](https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-03.md)
- Inverted direction mask sends rebalance swaps the wrong way [E4](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AH-03.md)

## Impact and severity
High: full drain of router funds [E1](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-08.md), theft from vault or withdraw manager [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-10.md), wrong minted amounts [E3](https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-03.md), and financial loss from misdirected rebalances [E4](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AH-03.md). Severity rises when the wrong-asset path is reachable without special approvals, or when the assumption holds in tests but not in production token ordering.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-08.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-10.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-03.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AH-03.md