# _doSherX optimistically assumes premiums will be paid

SherX payout uses optimistic calcUnderlying assuming all accrued premiums are paid, but debt is only settled when it would revert, inflating user payouts.

- Payout: Audit contest
- Severity: medium
- Program: Sherlock
- Found by: cmichel
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-sherlock-findings/issues/107
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-sherlock%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity vuln:accounting-error vuln:business-logic

**Target:** SherX premium accounting / _doSherX payout logic (Solidity)
**Root cause:** _doSherX computes amounts via LibSherX.calcUnderlying(totalSherX) assuming all outstanding premiums are paid, but only calls payOffDebtAll for tokens where amounts[i] > sherXUnderlying, so unpaid debt is not reflected in the payout calculation.
**Steps:**
1. Read `_doSherX`: `amounts = LibSherX.calcUnderlying(totalSherX)` treats all accrued premiums as paid.
2. Note `payOffDebtAll(tokens[i])` is only invoked when `amounts[i] > ps.sherXUnderlying` (to prevent reverts).
3. For a token where the protocol lacks balance to pay premiums, debt is never settled but calcUnderlying still counts it.
4. User receives an inflated SherX payout based on the optimistic underlying amount.
**How found:** Code review of _doSherX noticing the comment 'only execute to prevent tx reverts' and that calcUnderlying is an optimistic view of unpaid premiums.
**Exploitation:** A user claims SherX while a protocol's premium debt is unpayable; the optimistic calcUnderlying inflates their payout, extracting more underlying than the pool actually holds in settled premiums.
**Insight:** When a payout formula assumes receivables are collected, check whether the collection call is conditional (e.g. only to avoid reverts) — conditional settlement means the formula overstates assets and inflates payouts.