---
name: defi-accounting-and-math
description: "Guides a reviewer through auditing DeFi smart-contract bookkeeping and math—share/rate math, rounding, fees, rewards, balances, and accounting drift—by mapping state and mutation paths and applying a pattern checklist to find where the books diverge from token reality."
---

# DeFi accounting and math bugs

Smart contracts whose bookkeeping is wrong: share and exchange-rate math, rounding, rewards, fees, balances that drift from reality.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 95 newer reports it was not written from: following it finds about 53% of them._

## How to review DeFi accounting and math

**Approach.** Treat every number in state as a claim that must be provable from token movements. Your job is to find where the contract's books disagree with reality: shares, rates, fees, rewards, balances. Assume arithmetic is hostile until shown otherwise.

**Map first.**
1. Every stored quantity: balances, shares, totals, accumulators, indices, checkpoints, rates, fees, debt.
2. Every mutation path that writes them (deposit, withdraw, swap, claim, liquidate, settle, pause).
3. Every read that consumes them (payout, fee, ratio, eligibility, cap).
4. Token movement points and their actual deltas.

**Questions that surface bugs.**
- For each write: is the matching global total, index, or checkpoint updated on *every* path, including early returns and zero amounts?
- Is the value checked the same value used (account, token, count, unit)?
- Is the rate/price computed *after* all pending value is settled?
- Which direction does rounding go, and can it reach zero?
- Are shares and assets ever mixed, or decimals unnormalized?
- Can a live balance be inflated by donation or a stale snapshot reused after mutation?
- Does a payout have a matching debit and backing?
- Do caps, guards, and comparisons use cumulative state and the right operand order?

**Using the patterns.** The list is a checklist, not a script. Walk it against your map: for each pattern, name the concrete state variable and path it would touch. Prioritize paths where value exits (withdraw, claim, liquidate, refund) and where totals are shared across users. When a pattern matches, trace the exact numbers end-to-end with a small example (deposit, accrue, withdraw) and confirm the invariant `sum(claims) <= backing`. Report the path, the mismatched quantity, and the invariant broken.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Fee unit, count, base and payer bugs
Check each fee's unit, deduction count, base, and which account pays it

_124 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/fee-accounting-mismatch.md

### Stale global total accounting drift
A balance or asset moves on one path while the matching global total, checkpoint, or sync hook is skipped

_124 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/stale-total-not-updated.md

### Rounding to zero in share math
Floor division yielding zero shares, debt, or rate then consumed as valid state

_123 reports · one confirmed bounty: $100,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/rounding-to-zero-mint.md

### Validated-vs-used operand mismatch in accounting
Does the account, key, count, or token checked equal the one actually debited, credited, or read?

_122 reports · one confirmed bounty: $560,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/wrong-variable-comparison.md

### Stale cached balance in accounting
Balance, reserve, or snapshot read before a mutation, then reused in payout, fee, or debt math

_103 reports · one confirmed bounty: $95,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/stale-cached-balance.md

### Checked subtraction underflow locks funds
Subtractions where the subtrahend can exceed the minuend, reverting settlement, withdrawal or liquidation paths

_94 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/underflow-revert-dos.md

### Stale accrual in share and rate math
Is every price, share rate, or reward metric computed after all pending value is settled into state?

_76 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/stale-exchange-rate.md

### Reward index not synced on balance change
Balance, weight, or emission-parameter writes that skip the reward-index checkpoint first

_74 reports · 2 confirmed bounties: $21,000 and $25,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/reward-index-desync.md

### Token decimals not normalized in accounting
Amounts from tokens or oracles with different decimal scales summed, compared, or scaled without conversion

_73 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/decimal-scaling-mismatch.md

### Momentary balance earns full-period rewards
Reward math reads live balance, supply, or score instead of the value held during the accrual interval

_67 reports · one confirmed bounty: $20,750._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/reward-snapshot-abuse.md

### Credit without matching token movement
A balance, share, or bid recorded without the matching token transfer, or a transfer result ignored

_67 reports · one confirmed bounty: $2,000,042._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/phantom-balance-credit.md

### Rounding direction favors user
Conversions and subtractions where the truncated remainder lands on the caller's side, not the protocol's

_66 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/rounding-direction-drain.md

### Share price inflation via donation and rounding
Assets read from live balances or protocol-favor rounding let price-per-share move without paid mint or redeem

_65 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/share-inflation-donation.md

### Shares vs assets unit mismatch
A share amount used where an asset amount is expected, or the reverse, in balances, ratios, or payouts

_62 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/share-asset-unit-confusion.md

### First depositor share inflation
Empty-pool share minting without dead shares or virtual offset, and totalAssets inflatable by direct transfer

_57 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/first-depositor-share-skew.md

### Funds Paid to Wrong Recipient
Transfers, refunds or rewards sent to caller, contract or wrong address instead of the intended owner

_57 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/fund-routing-wrong-recipient.md

### Stale state after transitions
Old flags, mappings or fee fields left live after a transition, letting finished flows reopen or mix state

_50 reports · 2 confirmed bounties: $10,000 and $1,000,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/stale-flag-not-cleared.md

### Stale reward claim state
Claim guards keyed on mutable IDs, unreset accruals, or non-idempotent accumulators that pay rewards twice

_48 reports · one confirmed bounty: $70,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/reward-double-claim.md

### Checkpoint and epoch boundary off-by-one
Write and read paths using different boundary predicates, so one record is double-counted, dropped, or misattributed

_48 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/checkpoint-epoch-boundary.md

### Missing or wrong slippage guard
Swap or withdrawal where the min-out/max-in bound is absent, miscompared, or bypassed by a later leg

_47 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/slippage-check-missing.md

### Interest accrued after state change
Debt, rate or term mutated before interest accrual, so interest is double-counted, skipped or mispriced

_45 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/interest-accrual-order.md

### Donated tokens counted as assets
Value from raw balanceOf or share price that unsolicited transfers can inflate

_43 reports · one confirmed bounty: $100,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/donation-inflates-tvl.md

### Assignment vs accumulation accounting bugs
Accumulators written with = instead of +=, or per-account state overwritten by later calls

_41 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/state-overwrite-accumulate.md

### Unshared losses in DeFi accounting
Losses realized late or recorded wrong, so early exiters escape and remaining holders absorb the shortfall

_38 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/bad-debt-socialization.md

### Queue and array index corruption
Stale or miscomputed array/queue indices after removal, merge, or wrap that misroute funds or freeze positions

_38 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/queue-index-accounting.md

### Unsafe downcast truncation in accounting
Narrowing casts of amounts, lengths, or scaled values that wrap, truncate to zero, or revert

_37 reports · 2 confirmed bounties: $50,000 and $1,000,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/unsafe-narrow-cast.md

### Zero-value edge paths in DeFi accounting
Zero amounts, zero balances, or zero bounds that skip checks, re-fire payouts, or brick accounting

_36 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/zero-quantity-edge.md

### Unchecked arithmetic wraps accounting
Unchecked or narrow-width math on balances, shares, accumulators or user prices that can wrap

_34 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/unchecked-overflow-wrap.md

### Precision truncation vs validation mismatch
Value checked or stored at different precision than computed; truncation slips past a guard

_33 reports · one confirmed bounty: $290,497._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/precision-truncation-validation.md

### Double-debited DeFi accounting
One event reducing a total or balance through two overlapping paths, or a term already reflected in the base

_31 reports · one confirmed bounty: $1,050,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/double-decrement-total.md

### Cap checks that ignore cumulative state
Cap or limit checked against this increment only, not the accumulated total or global state it protects

_30 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/cap-check-incomplete.md

### Zero or dust fee basis bypass
Fee computed from a zeroable or caller-controlled basis, or skipped by an early return, while value still settles

_28 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/fee-bypass-zero-amount.md

### Asset assumption mismatches in transfers
Code trusting ERC20/native assumptions instead of actual transfer, balance, and approval outcomes

_24 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/token-return-semantics.md

### Dust notify resets reward vesting
Permissionless notify or deposit rewriting reward rate, period, or user start time without checkpointing accrued rewards

_23 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/reward-rate-reset-grief.md

### External call before state commit
State written after an external call, letting a nested call read stale or overwrite accounting

_23 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/reentrancy-before-state-update.md

### Fee-on-transfer accounting divergence
Stored amounts or shares credited from requested amount, not measured balance delta after token moves

_23 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/fee-on-transfer-mismatch.md

### Duplicate entries double-count in loops
Caller-supplied lists summed or paid per entry without a uniqueness check

_23 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/duplicate-entry-double-count.md

### Partial refund and overpayment accounting
Refund or charge computed from one iteration, one branch, or a capped amount instead of the true total

_23 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/refund-accounting-partial.md

### Balance-delta snapshot reentrancy
Before/after balanceOf snapshots around external calls that nested code can inflate, skew, or zero

_22 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/balance-delta-reentrancy.md

### Early return skips accounting step
Branches that exit before recording the state change they were meant to pair with

_22 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/early-return-skips-accounting.md

### Spot price in share and reward math
Share, NAV or reward math reading manipulable AMM reserves or spot price instead of a TWAP or sound oracle

_21 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/oracle-spot-manipulation.md

### Reward base reduced before accrual
Accrual divides by a base mutated before settlement, or pays on stale or post-change balances

_19 reports · one confirmed bounty: $4,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/reward-base-reduced.md

### Codeless or zero address credited
Transfers or registries that accept address(0) or codeless addresses and still credit balances

_17 reports · one confirmed bounty: $100,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/zero-address-or-codeless-token.md

### Unbounded caller-supplied duration or period
Caller-controlled duration, gas price, fee, or lock timer skews penalty, reward, refund, or vesting math

_17 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/unbounded-caller-duration.md

### AMM swap formula and invariant errors
Check swap math, reserve indexing, token cardinality, and parameter meaning against the pool invariant.

_16 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/swap-formula-parenthesization.md

### Held-back tokens never refunded on exit
Exit paths that keep shares, rewards, or surplus instead of returning them to the user

_16 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/unrefunded-held-tokens.md

### Fee scaling and cap mismatch
Fee parameters whose unit, scale, or bound disagrees with the cap or formula they feed

_14 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/fee-parameter-scaling.md

### Gas and fee formula accounting gaps
Gas charged, refunded, or metered on a basis that omits real cost or mismatches scope

_14 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/gas-estimate-omits-cost.md

### Double-counted DeFi accounting aggregates
Same delta applied twice to a tracked total, or a getter field already included in another

_12 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/double-count-protections.md

### Liquidation accounting and math bugs
Liquidation paths that trust nominal inputs, skip balance updates, or ignore penalty and accrued interest

_11 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/liquidation-accounting-error.md

### Utilization check ordering and bypass
Ratio guards checked mid-action, on one side only, or against stale state, letting utilization pass caps

_11 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/utilization-check-ordering.md

### Unaccounted collateral after settlement
Settlement or claim paths that skip state cleanup, leaving collateral, earnings, or balances live and reusable

_11 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/unaccounted-collateral-settlement.md

### Stale collateral ratio in liquidation paths
Check every path that computes collateral, debt or CR for stale prices, wrong base, or omitted PnL.

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/collateral-ratio-stale.md

### Interest compounding and frequency dependence
Interest math that depends on how often it is applied, or resets that discard remainders

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/interest-compounding-formula.md

### Self-referential fee and beneficiary bugs
Fee, penalty or reward routed back to the payer or its own pool, so the charge nets to zero

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/self-referential-fee.md

### Payout without backing or accounting
Outgoing transfers or payouts not matched by a debit, incoming payment, or backing reduction

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/unbacked-or-unaccounted-payout.md

### Stranded funds with no exit path
Inflows whose matching outflow is missing, disabled, capped, or access-restricted, leaving tokens unreachable

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/stranded-funds-no-withdrawal-path.md

### Call semantics and return value mismatches
Ignored return values, wrong call vs delegatecall, and post-conditions checked against the wrong token or balance

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/unchecked-return-or-call-semantics.md

### Unset or uninitialized state defaults to zero
Config keys, storage slots, or dicts never set or finalized, so reads return zero and zero out accounting

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/stale-or-unset-config-default.md

### Reward numerator denominator asset mismatch
Ratio or total whose numerator and denominator count different assets, units, or scaling

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/reward-numerator-denominator-mismatch.md

### Caller-supplied pool trusted in accounting
Pool or account address from calldata used in eligibility, reward, or liquidity math without key or ownership check

_9 reports · one confirmed bounty: $505,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/caller-supplied-pool-or-account-trusted.md

### Sign errors in premium and payout math
Signed deltas, premiums and margins crossing boundaries where a cost is added instead of subtracted

_8 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/sign-error-in-payout.md

### Counter never incremented or reset
Guards keyed on a counter that is never incremented, reset, or initialized correctly

_8 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/counter-never-incremented.md

### Backing math omits liabilities
Net-equity, surplus, or liquidity math that sums assets but drops borrows, deficits, or owed fee buckets

_8 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/accounting-omits-liabilities.md

### Replay window exceeds action period
Check whether a commit, claim or withdrawal window outlasts the action it guards, letting it be replayed or double-counted.

_7 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/replay-window-exceeds-period.md

### Timestamp guard vs stored value mismatch
Guard validates one timestamp or formula but code stores another; check every state write bumps the field

_7 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/guard-store-timestamp-mismatch.md

### Commingled balances without separate accounting
Functions that move raw balanceOf or address(this).balance instead of a tracked per-category amount

_7 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/commingled-balance-no-separation.md

### Asset identity mismatch in DeFi accounting
Same asset or pool value tracked under different identities or denominators across accounting paths

_6 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/cross-context-asset-identity-mismatch.md

### Dust blocks liquidation and clearing
Exact-zero or empty-collateral guards that dust can satisfy or defeat, and rounding that never reaches zero

_5 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/liquidation-dust-griefing.md

### Iterative solver non-convergence in DeFi math
Newton solvers that oscillate, underflow, or return non-converged values instead of reverting on extreme inputs

_5 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/iteration-nonconvergence.md

### Inverted or wrong comparison guards
Check comparison direction and operands in guards; valid ops reverting or invalid passing

_5 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/inverted-or-wrong-comparison-guard.md

### Missing minimum and dust threshold checks
Guards on minimum payout or position size that partial fills, splits, or threshold switches can bypass

_5 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/missing-minimum-or-dust-check.md

### Merkle hash collision and truncation bugs
Leaves hashed like nodes, raw values used as leaves, or truncated hashes weakening collision resistance

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/merkle-leaf-hash-collision.md

### Unrealized PnL as Collateral
Does the sufficiency check count unrealized profit, pending PnL, or pending fees as real collateral?

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/unrealized-pnl-collateral.md

### Renewal resets period instead of extending
Renewal or top-up paths that set start time to now rather than prior expiry

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/renewal-resets-instead-of-extends.md

### Fee divisor uses wrong aggregate base
Fee or rate divided by an aggregate denominator while settlement or pricing applies to a narrower subset

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/divisor-uses-wrong-base.md

### Execution-time fee and rate reads
Fees, rates or terms read from mutable storage at execution instead of signed or snapshotted values

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/fee-or-rate-read-at-execution.md

### Positional index mismatch across arrays
Loops or helpers pairing i with i+1, or positional arrays against a list that mutates on removal

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/index-or-array-positional-mismatch.md

### Penalty and slash base errors
Penalty or slash math using the wrong base: full duration, config threshold, or one reward stream

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/penalty-or-slash-base-wrong.md

### Per-address reward eligibility without ledger
Reward or tier eligibility keyed only to caller address or live balance, with no per-address claim record

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/reward-sybil-fresh-addresses.md

### Signature replay via inconsistent encoding
Same proof or signature decoded differently by validator and consumer, letting one claim count many times

_4 reports · 2 confirmed bounties: $1,000,000 and $2,000,000._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/signature-replay-encoding-mismatch.md

### Bitmap shift and mask width bugs
Shifts at or beyond bit width silently return zero; masks with wrong width clear adjacent packed fields

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/bitmap-shift-out-of-range.md

### Swapped argument order in DeFi swaps
Check token/amount argument order and path direction against pool signatures and encodings

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/argument-order-swap.md

### Self-inclusive amount guard reverts
Guards comparing an amount to a total that already includes it, or to balances skewed by external transfers

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/self-inclusive-total-comparison.md

### Paused-state accounting and fee accrual bugs
Early returns, zero-amount calls, and time-based accrual that ignore pause or disabled state

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/paused-token-fee-accrual.md

### Bundled settlement loop revert DoS
Settlement loops pushing transfers or shares where one failing item reverts the whole batch

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/settlement-loop-single-failure.md

### msg.value reused in loops
Payable batch or swap loops forwarding full msg.value per iteration instead of a per-item amount

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/msg-value-loop-reuse.md

### Strategy liquidity assumed full on withdraw
Withdraw/valuation math assumes full strategy liquidity; check leftover amounts and actual tokens received before mutating shares

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/partial-withdrawal-full-liquidity-assumption.md

### Votes deducted from wrong account
Third-party calls and zero-address delegation that mutate vote checkpoints keyed off msg.sender instead of the resolved owner

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/vote-accounting-wrong-owner.md

### Share mint priced before asset deposit
Shares computed before assets arrive or after balance/ratio state changes, diluting or inflating value

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/share-mint-before-asset-transfer.md

### Repeatable claim inflates reward accumulator
Claim, distribute or bonus paths callable repeatedly without resetting per-claim state or capping payout

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/reward-claim-replay.md

### Unlock remainder carryover accounting bug
Accumulator fields (remainder, leftover time) not reset or carried correctly across lock/unlock or period boundaries

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/stale-remainder-carries-forward.md

### Skipped time window on first-action branch
Deadline or window checks nested in the normal branch, skipped by first-action or special-case branches

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/missing-time-window-check.md

### Tick bounds vs price bounds mismatch
Two related bounds derived from different accumulators or unaligned ticks, breaking ordering or liquidity math

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/tick-bounds-inconsistent.md

### Unrefunded Excess Native Value
Payable functions accepting msg.value above the required amount without refunding or accounting for the surplus

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/unrefunded-native-overpayment.md

### Shared vault list conflicting purposes
One registry or balance formula reused for accounting and routing; check every consumer's required contents and valuation

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/shared-vault-list-conflict.md

### Dust rounding bypasses minimum amount checks
Floored inputs or rates that hit zero while full value moves, skipping min-amount and slippage checks

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/dust-rounding-bypasses-min-check.md

### Rebasing token allowance unit mismatch
Allowances or balances stored in nominal units on rebasing or share-based tokens, letting spenders drain more after a rebase

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/stale-allowance-rebasing.md

### Live-price margin recompute bugs
Margin stored in token units but deltas computed in USD at a different price; refunds ignoring unrealized loss

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/margin-collateral-recomputed-at-live-price.md

### Zero-balance branch skips aggregate update
Early return or zero-amount branch that leaves totals, debt, or claimed amounts unchanged

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-accounting-and-math/zero-branch-skips-total-update.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Transfer hook dumps reserves**: Token transfer hook or callback moves its own reserves into a pair on sell (https://bugbountylibrary.com/r/dhl%3A20260604-atm.md)
- **Caller-supplied metadata trusted in accounting**: Decimals, loan source, or virtual price taken from caller or external input without validation (https://bugbountylibrary.com/r/dhl%3A20260420-juiceboxrevloans.md)
- **Claim amount from live balance**: Reward or yield claim computes amount from current balance instead of a snapshotted stake (https://bugbountylibrary.com/r/dhl%3A20250427-aventarewardclaim.md)
- **Claim collects whole-pool fees**: Fee claim loops over all pool fees instead of the caller position share (https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-01.md)
- **Correlated modulo attribute bias**: Multiple rank attributes derived from one value via modulo yielding few combinations (https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AM-01.md)
- **Empty pool donation triggers fee or rebalance drain**: Zero-supply or zero-liquidity branch where a tiny donation or first action skews rate or drains fees (https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-7.md)
- **Exit rate decoupled from deposit rate**: Burn or withdraw returns underlying at a fixed ratio unrelated to the deposit exchange rate (https://bugbountylibrary.com/r/dhl%3A20250716-vds.md)
- **Fee-adjusted price with full reserve update**: Pricing subtracts fee but reserve or balance update uses the full pre-fee amount (https://bugbountylibrary.com/r/dhl%3A20260328-vtswaphook.md)
- **Frequent reward updates discard accrued rate**: Per-token reward rate recomputed on each update with rounding that drops accrued remainder (https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md)
- **Inherited msg.value mints unbacked tokens**: Delegatecall or internal call that reuses msg.value without a matching transfer to mint or credit (https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-inflation-spend-bugfix-review-6m-payout.md)
- **Mint and burn payout mispricing**: Burn or redeem payout exceeds mint cost due to missing scaling or virtual price factor (https://bugbountylibrary.com/r/dhl%3A20260315-unverified-237d.md)
- **Missing finalize leaves arbitrary defaults**: Config or dictionary copy path that skips a finalize step, leaving unset keys at default values (https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-03.md)
- **Negative slope delta inflates past balance**: Historical voting-power checkpoint math where a negative slope delta is added instead of clamped to zero (https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.13.md)
- **Parameter change without reward index checkpoint**: Admin setters for rates or multipliers that do not checkpoint the reward index first (https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-06.md)
- **Per-token ceil rounding socializes bad debt**: Rounding up per token or per unit in liquidation or settlement that over-sizes dust and spreads loss (https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.1.md)
- **Pre-wrap amount forwarded strands wrapped tokens**: Wrap or deposit flow that forwards the pre-wrap amount, leaving wrapped tokens stuck in the contract (https://bugbountylibrary.com/r/sherlock%3A2024-02-jala-swap%3AM-2.md)
- **Repay accepts non-borrowed token erasing debt**: Repay path pops or zeroes borrow entry without verifying token matches the recorded debt (https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-02.md)
- **Reported amount not reduced by deducted fee**: Fee subtracted from balance but returned or emitted amount still shows gross value (https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.5.md)
- **Reward threshold gaming via stake timing**: Reward eligibility or fee tier keyed to a manipulable threshold that stake/unstake can cross at will (https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-10.md)
- **Rewards accrue without cap or end time**: Reward accrual loops or internal reward writes lacking an end time or balance check. (https://bugbountylibrary.com/r/sherlock%3A2023-02-olympus%3AM-5.md)
- **Share mint against skewed pool value**: Mint or deposit priced from manipulable or depressed pool value without slippage guard (https://bugbountylibrary.com/r/sherlock%3A2022-09-sherlock%3AH-1.md)
- **Skipped fee downscaling drains fees**: Fee or share scaling applied on deposit but skipped on withdraw, letting a flash depositor capture fees (https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-04.md)
- **Solvency check omits PnL component**: Available-balance or close-price profit check ignores one leg of position value, passing insolvent accounts. (https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-7.md)
- **Threshold branch causes redeem rate jump**: Redeem or exchange-rate function with an if-threshold branch that changes the rate formula discontinuously (https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-9.md)
- **Tiny chunks zero weighted average contribution**: Weighted-average or APR accumulator divides per-chunk before summing, losing small chunks (https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-12.md)
- **Token type not validated on deposit**: Deposit path accepts any token interface without checking ERC20 vs ERC721 type (https://bugbountylibrary.com/r/sherlock%3A2024-01-looksrare%3AH-1.md)
- **Transfer helper returns input not actual**: Wrapper returns requested amount instead of measured received shares or tokens (https://bugbountylibrary.com/r/c4%3A2022-10-blur%3AH-01.md)
- **Unbounded caller-supplied length or duration**: Caller-supplied lengths, durations, or periods used in loops or math without bounds. (https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-8.md)
- **Unreachable guard bounds divergence**: Clamped shared input makes a guard unreachable, letting values diverge below threshold (https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-17.md)
- **Zero-liquidity withdraw pays full balance**: Withdraw path with zero shares or zero liquidity that returns the entire vault or pool balance (https://bugbountylibrary.com/r/dhl%3A20261009-bitbay.md)
- **msg.value used instead of pulled amount**: ETH or token amount taken from msg.value rather than the actually transferred or pulled amount (https://bugbountylibrary.com/r/sherlock%3A2022-12-notional%3AH-6.md)