# Kill-switch bypass on alternate paths

Does every path that moves reserves or fees honor the freeze, pause, or config flag?

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-09-01. Updated 2026-10-29._

## How it works
A protocol adds a guard (kill switch, freeze, pause, or config flag) to one entrypoint and assumes that guard controls the whole behavior. But other entrypoints reach the same state change indirectly: a withdrawal that internally swaps, a fee path that pulls liquidity from an external pool, or a fee parameter read from user-mutable config at execution time. The guard's assumption ("swaps are stopped, so price can't move" or "the fee is what the operator priced") breaks because the guarded action is reachable through an unguarded path.

## Where it shows up
- A `kill_swap`/pause check on `swap` only, while `withdraw_one_coin`, `remove_liquidity_imbalance`, or add/remove-LP also mutate reserves [E2](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.7.md)
- Fee or settlement code that unwraps/withdraws from an external pool (AAVE/Compound) whose withdraw reverts at 100% utilization [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AM-1.md)
- Off-chain operator pricing a reward from a user-controlled flag (`onlyFees`) that is read again on-chain at execution [E3](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23.md)
- Any config flag that feeds fee math and is mutable between quote and execution

## How to review
Enumerate every entrypoint that changes the protected state (reserves, fees, balances), not just the obvious one. The invariant: if the guard is on, no reachable path may move the guarded quantity. For stableswap, proportional withdrawal preserves the reserve ratio but user-composed withdrawal does not [E2](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.7.md). For fee paths, check whether an external withdrawal can be forced to revert, and whether the fee parameter is bound to the signed transaction rather than re-read from mutable config [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AM-1.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23.md).

## Variants seen
- Freeze bypass via imbalanced/one-sided withdrawal doing an internal swap [E2](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.7.md)
- Order execution griefed because fee unwrap hits a 100%-utilized lending pool [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AM-1.md)
- Front-run flip of a user config flag to cut the protocol fee [E3](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23.md)

## Impact and severity
Pool price skew and 84% drain of one token [E2](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.7.md); stop-loss/take-profit orders forced to worse prices [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AM-1.md); protocol fee loss [E3](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23.md). Severity rises when the bypass is permissionless and time-critical actions (liquidations, stops) depend on the guarded path.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AM-1.md
- E2: https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.7.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-23.md