# Missing owner check misroutes debt

Repay, claim, or unstake paths accepting an onBehalf or owner that is not bound to the real position holder

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2024-09-03. Updated 2026-10-29._

## How it works
A function that writes per-user accounting (debt, stake, risk, collateral) takes an `onBehalf`/`owner`/beneficiary parameter but never binds it to the actual position holder. The caller chooses whose ledger entry to change. The broken assumption: "the address passed in is the address that owns the position." When that is false, one account's balance is debited or credited against another's, and the two ledgers drift apart from reality.

## Where it shows up
- Repay/redeem/unstake/claim functions with an `onBehalf`, `owner`, or `beneficiary` argument.
- Validation that only checks `!= address(0)` and stops there [E3](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-02.md).
- Per-user mappings keyed by address (`userScaledBorrow[onBehalf]`, `amountLost[owner]`) where the underlying asset is transferable [E1](https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AM-06.md).
- Unlock/close conditions based on one counter (e.g. `amountStaked == 0`) while a second counter (residual risk) is ignored [E1](https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AM-06.md).
- Ownership that can change mid-flow (NFT mint/transfer during an auction) while logic assumes it is fixed [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-radicalxchange%3AM-2.md).

## How to review
For every write to per-user accounting, trace the key: is it the caller, or an arbitrary parameter? The invariant: the address whose ledger is modified must equal the address that actually holds the position, or the caller must be explicitly authorized for it. Check that closing/unlocking a position also clears every related counter, not just the primary balance. For transferable assets, confirm risk/loss is keyed to the token, not the current owner, or is settled before transfer. For auctions, confirm ownership cannot change between bid and settlement.

## Variants seen
- Unstake unlocks NFT while residual StakeAtRisk remains; loss keyed to owner address, so a buyer's win absorbs the seller's risk [E1](https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AM-06.md).
- NFT minted to a new address mid-auction, collateral credited to new owner while only fee was paid [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-radicalxchange%3AM-2.md).
- `isolateRepay` accepts arbitrary `onBehalf`, decrementing a stranger's scaled borrow so their loan underflows at liquidation [E3](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-02.md).

## Impact and severity
High: theft of protocol or user funds [E1](https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AM-06.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-radicalxchange%3AM-2.md), and forced underflow/insolvency of an unrelated borrower's position [E3](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-02.md). Worse when the misrouted write feeds a liquidation or settlement path, turning a bookkeeping drift into direct loss.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AM-06.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-radicalxchange%3AM-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-02.md