# Commingled balances without separate accounting

Functions that move raw balanceOf or address(this).balance instead of a tracked per-category amount

_Area: DeFi accounting and math bugs. Seen in 7 disclosed reports; latest 2026-06-07. Updated 2026-10-23._

## How it works
A contract holds one token balance that serves several purposes at once: user principal, pending payouts, accrued fees, or rewards. Nothing in storage records how much belongs to each category, so any code that reads the raw balance (`token.balanceOf(address(this))` or `address(this).balance`) treats the whole pool as its own. The broken assumption is that "the contract's balance equals the amount this function is entitled to move." Once two categories share a balance, a withdrawal, transfer, or mint sized from the raw balance spends someone else's funds [E1](https://bugbountylibrary.com/r/sherlock%3A2023-06-gfx%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-sense%3AH-3.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-bond%3AM-5.md).

## Where it shows up
- Withdraw/sweep functions that transfer `balanceOf(this)` or `address(this).balance` to an owner or caller [E1](https://bugbountylibrary.com/r/sherlock%3A2023-06-gfx%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-sense%3AH-3.md).
- Fee collection and user payouts denominated in the same token, with no fee ledger [E1](https://bugbountylibrary.com/r/sherlock%3A2023-06-gfx%3AH-1.md).
- Staking contracts where `stakeToken` can equal `payoutToken`, so reward minting draws on staked principal [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-bond%3AM-5.md).
- A single reserve variable fed by multiple deposit paths (LP deposits and synth mints) [E4](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md).
- DEX/router integrations that record only the final token and ignore intermediate or residual balances [E2](https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AH-1.md).
- Wrapper contracts that aggregate many users under one on-chain identity, then transfer the full balance [E6](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md).

## How to review
The invariant: for every token, the sum of tracked category balances (principal + fees + rewards + pending payouts) must equal the contract's actual balance, and every outflow must be sized from a tracked variable, never from the raw balance. Check each function that transfers or mints: does it compute an amount from storage, or read `balanceOf`/`address(this).balance`? For each path that increases a reserve or balance, confirm it also mints shares or records a category entry; a deposit that bumps a shared variable without attribution donates value to existing holders [E4](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md). For router integrations, reconcile against the router's returned deltas, not an assumed single token [E2](https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AH-1.md). For aggregating wrappers, confirm partial-share transfers are possible [E6](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md).

## Variants seen
- Owner fee sweep takes users' unclaimed swapped tokens [E1](https://bugbountylibrary.com/r/sherlock%3A2023-06-gfx%3AH-1.md).
- Ejector receives entire target-asset balance including other users' yield [E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-sense%3AH-3.md).
- Reward claim spends staked principal when stake and payout tokens match [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-bond%3AM-5.md).
- Synth deposits credited to LP share value without share issuance [E4](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md).
- Intermediate batchSwap tokens unaccounted, risking premature liquidation [E2](https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AH-1.md).
- Shared lender identity blocks partial redemption [E6](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md).

## Impact and severity
Loss of user funds, stolen yield, locked redemptions, and wrongful liquidation [E1](https://bugbountylibrary.com/r/sherlock%3A2023-06-gfx%3AH-1.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2022-11-sense%3AH-3.md)[E6](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md). Severity is high: losses are direct and often irreversible, and worsen when the shared balance is large or the sweep is permissionless.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-06-gfx%3AH-1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2022-11-sentiment%3AH-1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2022-11-sense%3AH-3.md
- E4: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-06-bond%3AM-5.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md