# Backing math omits liabilities

Net-equity, surplus, or liquidity math that sums assets but drops borrows, deficits, or owed fee buckets

_Area: DeFi accounting and math bugs. Seen in 8 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
Accounting code computes a net figure (surplus, available liquidity, excess balance) from a formula that was correct when only one kind of claim existed. Later, a second claim is introduced — borrow debt, a bad-debt reserve, a protocol fee — but the formula is not updated. The omitted liability is silently treated as free surplus, so the contract mints, prices, or pays out value that is already owed elsewhere. The broken assumption is that "assets minus one bucket of claims" equals net equity; it only holds if every outstanding claim is subtracted.

## Where it shows up
- `abi.decode` or struct decoders that read only the asset field of a response that also carries borrow/liability fields [E1](https://bugbountylibrary.com/r/c4%3A2026-04-monetrix%3AM-01.md)
- `suppliedBalance()`-style helpers credited as positive backing with no matching debt subtraction [E1](https://bugbountylibrary.com/r/c4%3A2026-04-monetrix%3AM-01.md)
- Utilization or rate math using `total_supply - total_debt` while a separate `reserve_deficit` bucket exists [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-07.md)
- `excess = balanceOf(token) - owed` formulas where `owed` covers principal but not fees or other buckets [E3](https://bugbountylibrary.com/r/c4%3A2021-11-streaming%3AH-01.md)
- Any settle/mint path that pays out a computed surplus

## How to review
Enumerate every claim on the contract's assets (user principal, borrow debt, protocol fees, bad-debt reserves) and confirm each appears as a subtraction in every net-equity, surplus, liquidity, and rate formula. The invariant: `net = assets - sum(all liabilities)`; no liability bucket may be absent from any downstream computation that trusts it. For decoders, check that every field of the returned struct is consumed, not just the first. For `excess` math, list each owed bucket and verify it is deducted.

## Variants seen
- Partial decode drops borrow basis/value, inflating backing and minting phantom yield [E1](https://bugbountylibrary.com/r/c4%3A2026-04-monetrix%3AM-01.md)
- Bad debt moved to a reserve bucket but rate math still uses old supply-minus-debt invariant [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-07.md)
- Excess-deposit formula omits flashloan fee owed to governance, letting creator reclaim it [E3](https://bugbountylibrary.com/r/c4%3A2021-11-streaming%3AH-01.md)

## Impact and severity
High: phantom surplus minted to holders [E1](https://bugbountylibrary.com/r/c4%3A2026-04-monetrix%3AM-01.md), borrow rates mispriced by unrecoverable deficit [E2](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-07.md), and later depositors unable to withdraw after fees are drained [E3](https://bugbountylibrary.com/r/c4%3A2021-11-streaming%3AH-01.md). Severity rises when the omitted bucket is attacker-recoverable or feeds a rate oracle.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2026-04-monetrix%3AM-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-07.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-11-streaming%3AH-01.md