# Skipped accounting from decode and return errors

Cross-contract return type mismatches, missing returns, and tuple slot shifts that zero or misbind accounting values

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-08-20. Updated 2026-10-29._

## How it works
Accounting code trusts that a value it reads is the value the source produced. That assumption breaks in three ways: a cross-contract call decodes the return under the wrong type and falls into a default-zero branch; a handler branch omits a `return` and falls through into post-condition bookkeeping; a long positional tuple is destructured with a missing placeholder so values bind to the wrong slots. In each case the compiler stays silent and the checkpoint, refund index, or early-exit flag is computed from a zero or shifted value.

## Where it shows up
- Cross-contract calls where the callee's declared return type differs from the generic type parameter at the call site (e.g. `i128` vs `u128`).
- Decode-failure arms like `_ => 0` or `unwrap_or_default()` feeding supply, balance, or rate math.
- Handlers with several early-exit branches where only some branches `return` before shared post-processing.
- Functions returning long positional tuples, destructured at multiple call sites.
- Comments asserting a precondition ("valid, canonical, not duplicated") that the code above does not enforce.

## How to review
For every value entering accounting, trace it to its producer and confirm the type and position match exactly. The invariant: any decode failure, missing branch exit, or arity mismatch must be impossible or must abort, never silently yield a default that flows into bookkeeping. Concretely: diff callee return types against call-site generics [E1](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-09.md); check every early-exit branch returns before state-dependent post-processing [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-2.md); count tuple elements against every destructuring site [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03.md). Treat `_ => 0` fallbacks on financial values as defects unless proven unreachable.

## Variants seen
- Wrong ABI type on cross-contract call, decode fails, zero fallback skips reward checkpointing [E1](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-09.md).
- Missing `return` after slashing lets a forked-signature message be indexed as refundable [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-2.md).
- Missing comma in tuple destructuring shifts `active` into the reserve-ratio slot, corrupting escape-hatch logic [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03.md).

## Impact and severity
Rewards silently uncheckpointed [E1](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-09.md), invalid messages made refundable [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-2.md), and auction safety logic reading a false `active` flag [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03.md). Severity is high where the zeroed or shifted value gates fund movement or safety exits; silent defaults make it worse because no revert or log signals the drift.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-09.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AM-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AH-03.md