# Caller-supplied address trusted in accounting

Address from calldata used as source of truth for asset, balance, refund, or reward

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-10-20. Updated 2026-10-24._

## How it works
Accounting code needs a trusted answer to "which asset" or "how much." When that answer comes from an address in calldata and is used without checking it against a registry, factory, or the contract's own stored config, the caller controls the books. The contract records or pays out against a value the attacker chose, so internal balances drift from real holdings and the gap becomes withdrawable.

## Where it shows up
- A struct of user-supplied parameters validated field-by-field, with one address field (here the vault) skipped, and that field later read to pick the repayment asset [E1](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-08.md).
- A permissionless entry point that calls a caller-supplied contract and credits its returned amount as a deposit without checking the module's own balance increased [E2](https://bugbountylibrary.com/r/dhl%3A20261020-slicefundsmodule.md).
- A validation skipped on one code path (cross-chain) while a try/catch fallback still reads state from the unvalidated identifier [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2.md).

## How to review
Enumerate every field of every user-supplied struct and every address argument, then trace where each is later read as a source of truth. The invariant: any address that determines an asset, balance, refund, or reward must come from a registry/factory allowlist or be proven equal to the contract's own configured value. For E1, the recorded repayment asset must equal the lending vault's configured asset. For callbacks, require that the contract's own balance increased by the credited amount before recording a deposit [E2](https://bugbountylibrary.com/r/dhl%3A20261020-slicefundsmodule.md). For skipped validations, confirm the downstream path does not read attacker-influenced state [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2.md).

## Variants seen
- Unvalidated struct field (vault) used to pick the repayment asset, letting a borrower repay with a worthless self-created token [E1](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-08.md).
- Trusted return value from a caller-supplied source contract credited as a deposit, then paid from pooled reserves [E2](https://bugbountylibrary.com/r/dhl%3A20261020-slicefundsmodule.md).
- Nonexistent identifier accepted on one path; rescue logic records an attacker-chosen settlement token [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2.md).

## Impact and severity
Led to full vault drain [E1](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-08.md), ~$41K pooled ETH/USDC drain [E2](https://bugbountylibrary.com/r/dhl%3A20261020-slicefundsmodule.md), and inflated refunds [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2.md). Severity is high: the flaw converts directly into theft of pooled funds. It worsens when the entry point is permissionless and when the bad value is persisted into storage that later payout logic trusts.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-08.md
- E2: https://bugbountylibrary.com/r/dhl%3A20261020-slicefundsmodule.md
- E3: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.2.md