# Caller-supplied pool trusted in accounting

Pool or account address from calldata used in eligibility, reward, or liquidity math without key or ownership check

_Area: DeFi accounting and math bugs. Seen in 9 disclosed reports; one confirmed bounty: $505,000; latest 2026-10-03. Updated 2026-10-23._

## How it works
Accounting code needs a pool or account to read balances, supplies, or tick state from. When that address arrives in calldata and is used without proving it belongs to the protocol, the caller chooses the numbers the math runs on. The assumption that breaks: that the address passed in is the real, protocol-owned object. Nothing in the code ties it to a factory, registry, or derived PDA, so a fake or foreign account supplies attacker-chosen balances and the contract credits or mints against them.

## Where it shows up
- `remaining_accounts[0]` (or any index) read for state-dependent logic without `require_keys_eq` against a derived PDA [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-raydium-tick-manipulation-bugfix-review.md)
- A pool parameter used for both eligibility (e.g. `token0()==WBNB`) and reward math (`balanceOf`/`totalSupply`) with no factory/whitelist check [E2](https://bugbountylibrary.com/r/dhl%3A20260909-unifiprotocol.md)
- Checks that only compare `pool == msg.sender`, which any contract can satisfy [E2](https://bugbountylibrary.com/r/dhl%3A20260909-unifiprotocol.md)
- Purchase or reward amount computed from the contract's own balance rather than the caller's recorded commitment [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-20.md)
- Cap enforced on a user-supplied variable while the downstream value comes from a balance that can be pre-funded [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-20.md)

## How to review
For every address taken from calldata and used in math, find the line that proves it is the expected object: a derived PDA key check, a factory/registry lookup, or an ownership check. The invariant: any account whose balances or state feed accounting must be key-verified against the owning pool or protocol registry before use. Separately, confirm the amount credited is derived from the caller's recorded commitment, not from a balance anyone can inflate by transferring tokens in.

## Variants seen
- Attacker-supplied bitmap account flips tick bits and inflates liquidity [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-raydium-tick-manipulation-bugfix-review.md)
- Fake pool passes eligibility and reward math, draining the reward manager [E2](https://bugbountylibrary.com/r/dhl%3A20260909-unifiprotocol.md)
- Direct token transfer plus zero-amount call mints arbitrage tokens against contract balance [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-20.md)

## Impact and severity
Critical: full pool or reward-manager drain [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-raydium-tick-manipulation-bugfix-review.md)[E2](https://bugbountylibrary.com/r/dhl%3A20260909-unifiprotocol.md), unlimited token minting and price skew [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-20.md). Severity rises when the trusted address drives both eligibility and payout math, and when no registry exists to anchor the check.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-raydium-tick-manipulation-bugfix-review.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260909-unifiprotocol.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-20.md