# Guard set on one path only

Transient flags, re-accruals or ratio checks applied in one entrypoint but skipped in sibling paths

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2025-06-27. Updated 2026-10-25._

## How it works
A safety decision depends on state that is only established on one code path. A transient flag, a re-accrual call, or a balance-based ratio is set or refreshed in a wrapper entrypoint, but sibling paths reach the same sensitive operation without it. The assumption that "this state is always current when we act" breaks, so the check evaluates stale or attacker-shaped inputs and passes when it should not.

## Where it shows up
- Transient variables (e.g. `t_currentAccount`) read by pricing/oracle logic but written only in a router or wrapper function.
- External protocol integrations where users can call the external contract directly, bypassing the wrapper.
- Mitigation calls (re-accrual, rate refresh) gated on a specific caller or market, with other paths mutating the same debt/state.
- Utilization or ratio checks that read live token balances rather than a snapshot or invariant.
- Any `_borrow`/`_withdraw` internal reached from more than one public entrypoint.

## How to review
Enumerate every public entrypoint that reaches the guarded operation and confirm the flag/re-accrual/check runs on all of them, or that the operation is unreachable without it. For balance-based checks, verify the check uses values that cannot be changed within the same transaction (snapshots, debt accounting) rather than live balances. The invariant: at the moment of the sensitive action, the state the check reads must reflect the true post-action condition regardless of which path was taken.

## Variants seen
- Oracle misprices collateral because a transient withdrawal-request flag is set only in the lending router; direct Morpho borrowing skips it [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-4.md).
- Interest-rate manipulation fix re-accrues secondary markets only on the direct ETH borrow path; the leverage `_borrow` path skips `reAccrueBigBangMarkets()` [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-29.md).
- Utilization check reads current balance, so a same-transaction deposit inflates the denominator, then is withdrawn after borrow [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-2.md).

## Why fixes fail
E2 shows a prior fix applied to one caller (`msg.sender == bigBangEthMarket`) while the leverage path still mutated the same debt state, leaving the manipulation open [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-29.md).

## Impact and severity
Wrong collateral pricing enables over-borrowing [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-4.md); rate manipulation distorts markets [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-29.md); full pool drain from bypassed utilization [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-2.md). Severity is high where the bypassed path is user-reachable and the guarded action moves funds.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-4.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-29.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-2.md