# Stale-state parameter validation

Check whether new params are validated against latest stored state or an original/pre-update record

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2026-01-27. Updated 2026-10-25._

## How it works
A function accepts new parameters but validates them against a record that is not the current authoritative state: the original entry instead of the latest override, the caller-supplied field instead of the stored collateral id, or pre-adjustment values instead of post-adjustment ones. The check passes on data that no longer describes what will actually be used, so an invalid value slips through. The broken assumption is that the validation input equals the value the function will act on.

## Where it shows up
- Update/override functions that read a base record (`campaignList`) rather than the latest override record (`campaignOverrides`) [E2](https://bugbountylibrary.com/r/c4%3A2025-11-merkl%3AM-03.md)
- Refinance/renew flows that forward a caller-supplied identifier into offer validation instead of the stored escrowed id [E1](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-04.md)
- A user-supplied cap checked before a later fee or percentage increase is applied [E3](https://bugbountylibrary.com/r/c4%3A2021-06-realitycards%3AM-07.md)
- Any check placed before a mutation that changes the value being checked

## How to review
Trace the exact value the function will act on and confirm the validation reads that same value. The invariant: the state read by the check must be the state used by the effect, with no intervening mutation. For overrides, confirm validation anchors to the latest stored override, not the original. For escrowed-collateral flows, confirm the id fed to validation is the stored collateral id, not a caller field. For caps, confirm the cap is enforced on final post-adjustment values.

## Variants seen
- Caller-supplied tokenId validated instead of stored collateral id [E1](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-04.md)
- Override validated against original campaign, making later overrides revert [E2](https://bugbountylibrary.com/r/c4%3A2025-11-merkl%3AM-03.md)
- Cap checked pre-increase, so actual sum exceeds user cap [E3](https://bugbountylibrary.com/r/c4%3A2021-06-realitycards%3AM-07.md)

## Impact and severity
Led to refinancing against a different NFT than the lender approved [E1](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-04.md), blocked subsequent overrides [E2](https://bugbountylibrary.com/r/c4%3A2025-11-merkl%3AM-03.md), and bids exceeding the user's front-run cap risking foreclosure [E3](https://bugbountylibrary.com/r/c4%3A2021-06-realitycards%3AM-07.md). Severity rises when the stale check guards funds or user-specified limits.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-04.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-11-merkl%3AM-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-06-realitycards%3AM-07.md