# Repay clears wrong debt bucket first

Repay or redemption paths that zero one debt bucket while another stays unbacked or unliquidatable

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-07-15. Updated 2026-10-30._

## How it works
Debt is tracked in more than one bucket (virtual shares, earmarked debt, rawLocked vs totalLocked). Each bucket is assumed to move together with the others, so any single path that reduces one bucket is treated as reducing the whole debt. When a repay or redemption path clears one bucket first, the remaining buckets no longer reflect real backing: interest keeps accruing on shares nobody owns, or collateral is cut without a matching debt cut. The invariant that breaks is that every unit of debt must stay matched by a unit of backing and a unit of claimable reduction across all buckets.

## Where it shows up
- Share offsets (e.g. 1e6 virtual shares) that sit inside interest accrual but have no owner or collateral counterpart [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.4.md)
- Withdrawable computed as supply minus borrow, where borrow includes unowned shares [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.4.md)
- Repay/forceRepay that decrements an earmarked or special bucket before the regular debt [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md)
- Redemption logic that reads a bucket to decide how much debt to cancel [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md)
- Debt burn with no time-lock, allowing burn and re-mint in one block [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.21.md)
- Proportional-loss snapshots (rawLocked/totalLocked) taken at redemption time [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.21.md)

## How to review
For each path that mutates a debt bucket, list every bucket it touches and confirm the others are adjusted consistently. Check that virtual/offset shares are excluded from interest accrual and from withdrawable math, or are backed by a real owner. Check repay ordering: earmarked and regular debt must be reduced so redemption still cancels debt in proportion to collateral removed. Check that a borrower cannot cheaply change their weight in a loss snapshot within the same block (time-lock or same-block guard). The property: after any repay, burn or redemption, sum of debt buckets equals real outstanding debt, and collateral reduction is matched by debt reduction.

## Variants seen
- Unowned virtual borrow shares accrue interest, becoming unrepayable bad debt [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.4.md)
- Earmarked debt wiped first, later redemptions cut collateral without debt reduction, CDP unliquidatable via underflow [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md)
- Burn-then-mint sandwich around redemption dodges proportional collateral reduction [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.21.md)

## Impact and severity
Bad debt that reduces withdrawable supply [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.4.md); undercollateralized, uncloseable CDPs [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md); borrowers evading their share of losses, shifting it to others [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.21.md). Severity rises when the skew is silent and compounds over time, and when no liquidation path can correct it.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.4.md
- E2: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16.md
- E3: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.21.md