# Donated tokens counted as assets

Value from raw balanceOf or share price that unsolicited transfers can inflate

_Area: DeFi accounting and math bugs. Seen in 43 disclosed reports; one confirmed bounty: $100,000; latest 2026-06-29. Updated 2026-10-23._

## How it works
A contract treats `balanceOf(address(this))`, a vault's `totalAssets`/`pricePerShare`, or a raw balance delta as its own assets. That number includes tokens nobody deposited through the intended path: unsolicited transfers, accrued fees owed elsewhere, or rebased yield. The books then diverge from reality, and whoever can move tokens in directly controls the divergence. A related shape is an accounting-basis mismatch: two places measure the same tokens on different bases (net of fees vs raw balance), so a delta is misread as a deposit.

## Where it shows up
- `totalAssets`, NAV, TVL, reserves, or `pricePerShare` derived from `token.balanceOf(address(this))` [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-cream-finance-oct-2021.md)[E6](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md)
- Lending oracles reading a vault share price a donation can inflate [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-cream-finance-oct-2021.md)
- `liquidity()` = balance minus collateral, diverging from recorded `totalDeposits` [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-silo-finance-logic-error.md)
- Reserves stored net of fees while deposits are measured from raw balances [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md)
- User credit set from `address(this).balance` instead of measured swap output [E4](https://bugbountylibrary.com/r/c4%3A2024-05-loop%3AH-01.md)
- `totalAssets()` counting tokens that are not the vault's underlying asset [E6](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md)
- Rebasing tokens where any unaccounted balance delta is accepted as contribution [E5](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-2.md)
- Strategy deposits pulling from shared balance without checking accounted collateral [E8](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md)

## How to review
Grep every `balanceOf(address(this))`, every share-price/NAV consumer, and every balance-delta deposit check. The invariant: any value feeding shares, ratios, or payouts must come from internally tracked accounting, not raw balances, and both sides of a comparison must use the same basis. For each consumer ask what can inflate it and whether an outsider can trigger that inflation. For ratios, confirm whether the computation happens before or after the asset transfer. For forks, diff the accounting basis of `mint` vs `burn` and of reserves vs balances [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md).

## Variants seen
- Vault share price inflated by donating LP tokens, faking collateral [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-cream-finance-oct-2021.md)
- Donation pushes utilization above 100%, compounding interest [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-silo-finance-logic-error.md)
- Fee delta misread as user deposit in swap [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md)
- Donated ETH credited to claimer via balance-based credit [E4](https://bugbountylibrary.com/r/c4%3A2024-05-loop%3AH-01.md)
- Rebasing yield accepted as arbitrary contribution [E5](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-2.md)
- Non-asset token counted in `totalAssets` and also paid out on redeem [E6](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md)
- Donated tokens invested but never added to collateral accounting [E8](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md)

## Why fixes fail
Fixing one `balanceOf` consumer leaves others (redemption haircut, liquidation threshold) reading the inflated value [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-cream-finance-oct-2021.md)[E6](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md). Fee-bucket fixes must align every comparison of reserves and balances, not just swap [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md).

## Impact and severity
$130m bad debt [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-cream-finance-oct-2021.md), reserve drains [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md), inflated mints [E4](https://bugbountylibrary.com/r/c4%3A2024-05-loop%3AH-01.md), double-counted redemptions [E6](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md), hidden collateral evading liquidation [E8](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md). Severity rises when the inflated value feeds multiple downstream checks and any outsider can trigger the donation [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-cream-finance-oct-2021.md)[E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-silo-finance-logic-error.md)[E4](https://bugbountylibrary.com/r/c4%3A2024-05-loop%3AH-01.md)[E6](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md)[E8](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md); accidental transfers are lower risk.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-cream-finance-oct-2021.md
- E2: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-silo-finance-logic-error.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-05-loop%3AH-01.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-2.md
- E6: https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md
- E7: https://bugbountylibrary.com/r/dhl%3A20260327-est.md
- E8: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md