# Omitted asset from solvency check

Does every deposit/supply path feed the same asset set the health or liquidity check iterates?

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-05-22. Updated 2026-10-29._

## How it works
A solvency or liquidity check is only as complete as the set of assets it iterates. The bug is a mismatch between what the deposit/supply path records and what the health check reads. An asset is supplied, but the check never sees it — either because the check runs before the bookkeeping is populated [E1](https://bugbountylibrary.com/r/c4%3A2022-03-timeswap%3AH-01.md), because the asset was never added to the tracked set [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-2.md), or because the position record was never written [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-18.md). The invariant "check covers all supplied assets" silently fails, and the check passes or blocks on incomplete data.

## Where it shows up
- A `require`/ratio check inside a loop that reads accumulators incremented later in the same iteration [E1](https://bugbountylibrary.com/r/c4%3A2022-03-timeswap%3AH-01.md).
- A supply/deposit function that mints tokens but omits `enterMarkets` (or equivalent) while `borrow` calls it [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-2.md).
- Open-position functions passing a `removePosition`/delete flag, or otherwise no-oping the registry update [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-18.md).
- Any health check that iterates a stored list (`accountAssets`, position registry) rather than the actual balances.

## How to review
Identify the exact set the solvency check iterates, then confirm every path that adds collateral or debt updates that same set before the check runs. The property: for every supplied asset, it appears in the iterated set at check time, and the check is evaluated after all accumulators are populated. Diff open vs close functions for inverted flags [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-18.md); diff supply vs borrow for missing market-entry calls [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-2.md); confirm loop-invariant checks sit after the loop body updates [E1](https://bugbountylibrary.com/r/c4%3A2022-03-timeswap%3AH-01.md).

## Variants seen
- Check evaluated too early inside a loop, accumulators still zero [E1](https://bugbountylibrary.com/r/c4%3A2022-03-timeswap%3AH-01.md).
- Collateral market never entered, so liquidity loop skips it [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-2.md).
- Position record never written due to inverted remove flag [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-18.md).

## Impact and severity
High: withdrawal of all collateral while repaying zero debt [E1](https://bugbountylibrary.com/r/c4%3A2022-03-timeswap%3AH-01.md); borrows blocked despite sufficient collateral, a denial of core function [E2](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-2.md); broken strategy accounting [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-18.md). Severity rises when the omission is on the collateral side, since it converts directly into uncollateralized value.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-03-timeswap%3AH-01.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-18.md