# Relist or refund skips prior state check

Refund, relist, or claim path pays a party who never paid or already settled

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2024-08-06. Updated 2026-10-29._

## How it works
A payout path assumes the normal creation or settlement flow already happened: that the owner paid taxes, that a proposal is eligible, or that a caller is actually claiming. When a state flag, a user-supplied ID, or a function selector lets a party reach the payout without that precondition holding, funds move to someone who never contributed or who already settled. The broken assumption is "this path only runs after the prior state was established."

## Where it shows up
- Refund or tax-resolution calls keyed on owner, with no check of how the listing was created (e.g. liquidation vs normal) [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-16.md)
- Accounting windows bounded by a user-supplied ID whose timestamp is consumed before eligibility is validated [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-nouns-dao-2%3AH-1.md)
- Calldata whitelisting by function selector where overloaded signatures with defaulted bool/address args reach a more permissive branch [E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AM-2.md)
- Reward/balance arrays mutated on a path that did not actually claim or pay [E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AM-2.md)

## How to review
For every payout, refund, or credit, trace back to the state that must exist for it to be legitimate, and confirm that state is checked on this path, not assumed from the creation path. Invariant: a party is credited only if they paid the corresponding cost or are eligible at the moment of credit. For user-supplied IDs feeding timestamps or windows, verify eligibility before the value is used [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-nouns-dao-2%3AH-1.md). For selector-based dispatch, decode the actual arguments and branch on them, not the signature [E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AM-2.md).

## Variants seen
- Relist of a liquidation listing refunds taxes to an owner who never paid them [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-16.md)
- User-supplied lastProposalId sets the revenue window end via an ineligible proposal's timestamp [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-nouns-dao-2%3AH-1.md)
- Full-signature dispatch adds reward tokens to tokensIn even when _claim_rewards is false [E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AM-2.md)

## Impact and severity
Funds drained from protocol or other users' rewards; in E1 rewards meant for a rival proposal are captured, in E2 protocol funds leak via refunds, in E3 accounting is corrupted. Severity is high where the payout is direct and repeatable; worse when the trigger is cheap (a bogus proposal, a relist) and the credited party is attacker-controlled.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-03-nouns-dao-2%3AH-1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-16.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AM-2.md