# Bad-debt clearing leaves surplus unassigned

After bad-debt clearing, does every accumulator and pool field that held the debt get flushed or zeroed?

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-07-17. Updated 2026-10-29._

## How it works
Clearing bad debt removes a position and adjusts an accumulator, but the value that backed the debt (unassigned earnings, fees, or shared margin) is not moved to a tracked owner. The assumption that breaks: that clearing a position also settles every field the position touched. When the position is deleted first, guards that compare against its fields (e.g. `position.principal`, now zero) no longer fire, so the surplus stays in the pool, untracked and claimable by whoever acts next [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md).

## Where it shows up
- `clearBadDebt`-style functions that delete a position before reading its fields in a condition [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md)
- Accumulator deductions (`earningsAccumulator`) without zeroing the pool field the fee was credited to (`unassignedEarnings`) [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md)
- Guards of the form `borrowed == position.principal` where `principal` is zeroed by deletion [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md)
- Aggregate margin pools (`marginDepositedTotal`) where one position's negative PnL is subtracted from a shared total [E3](https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AM-7.md)
- Fund-tracking invariants (`balance == floatingAssets - floatingDebt - floatingBackupBorrowed + earningsAccumulator`) that no longer balance after clearing [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md)

## How to review
For each clearing/liquidation path, list every state variable the removed debt touched and confirm each is either flushed to a tracked owner or zeroed. The invariant: after clearing, no value attributable to the cleared position remains in a pool or accumulator without an assigned claimant, and the fund-tracking equation still holds. Check guard conditions against post-deletion state, not pre-deletion [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md). Check that per-position bad debt is isolated or charged to LPs/insurance, not socialized into a shared margin total [E3](https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AM-7.md).

## Variants seen
- Surplus left claimable when other maturities remain borrowed; only the terminal case assigns it [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md)
- Fee credited to a pool's `unassignedEarnings` never cleared when the debt is repaid, leaving funds untracked [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md)
- One underwater long's bad debt subtracted from a shared aggregate margin, draining solvent longs [E3](https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AM-7.md)

## Why fixes fail
E1 is a regression from a prior audit where only a partial fix was applied; the guard still compared against a zeroed field, so it worked only when borrowed reached zero [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md).

## Impact and severity
Stranded or stealable funds: anyone can claim unassigned earnings with a tiny deposit [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md); funds become untracked and the invariant breaks [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md); solvent users' margins are zeroed and withdrawals blocked [E3](https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AM-7.md). Severity rises when the surplus is permissionlessly claimable and when the bug only manifests in non-terminal states, which routine tests miss.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-11.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-12.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AM-7.md