# Double-counted accounting in DeFi protocols

Same value applied twice to an aggregate, or a getter field already included in another

_Area: DeFi accounting and math bugs. Seen in 16 disclosed reports; latest 2025-07-21. Updated 2026-10-23._

## How it works
An accounting aggregate (total debt, collateral, PnL, accounted balance, effective balance) is adjusted by a value that is already reflected elsewhere. Either a direct write and a shared updater both apply the same delta, or a getter returns a field that already contains another field the caller adds again. The tracked number then diverges from reality: balances inflate or deflate, and every downstream calculation that trusts the aggregate inherits the error.

## Where it shows up
- A close/liquidation path that both adjusts a global total and calls a shared updater recomputing the same PnL [E1](https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AH-3.md).
- A spec step reordered or run twice where the function has hysteresis or thresholds [E2](https://bugbountylibrary.com/r/cantina%3Aethereum_pectra_lighthouse%3A3.1.1.md).
- Manual token injections (reserves, liquidity) that bypass the formula behind an "accounted balance" invariant [E3](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-08.md).
- Integrations summing getter fields without confirming they are disjoint vs cumulative [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-11.md).
- Write-off branches that touch one counter but not its siblings (total_debt, liquidity, interest) [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md).
- A clamp-to-floor followed by a multiplier, so the floor itself gets scaled [E6](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26.md).
- PnL computed from a balance delta and then also subtracting a separately returned loss [E7](https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-02.md).
- A direction flag reused for a hypothetical opposite-direction check [E8](https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AM-3.md).

## How to review
For each aggregate, enumerate every write path and confirm each economic event changes it exactly once. The invariant: tracked aggregate equals the sum of underlying positions, and no event is applied by two paths. For getters, read the storage implementation to confirm returned fields are disjoint before summing. For stateful threshold functions, confirm one full update equals two partial ones, or that only one runs per cycle.

## Variants seen
- Direct adjust plus shared updater both applying PnL [E1](https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AH-3.md).
- Spec step run twice breaking hysteresis [E2](https://bugbountylibrary.com/r/cantina%3Aethereum_pectra_lighthouse%3A3.1.1.md).
- Injection path outside the accounting formula [E3](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-08.md).
- Cumulative getter field summed with its subset [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-11.md).
- Write-off missing a sibling counter decrement [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md).
- Multiplier applied after clamp [E6](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26.md).
- Loss subtracted from an already-loss-inclusive delta [E7](https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-02.md).
- Direction flag reused for opposite check [E8](https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AM-3.md).

## Impact and severity
Inflated collateral and TVL misprice positions [E1](https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AH-3.md)[E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-11.md); reserve funds become stealable [E3](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-08.md); bad debt blocks LP withdrawals even after repayment [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md); overpayment to one holder class at another's expense [E6](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26.md); misjudged liquidatability [E8](https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AM-3.md); consensus divergence in a client [E2](https://bugbountylibrary.com/r/cantina%3Aethereum_pectra_lighthouse%3A3.1.1.md). Severity rises when the wrong aggregate gates withdrawals, liquidation, or consensus.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AH-3.md
- E2: https://bugbountylibrary.com/r/cantina%3Aethereum_pectra_lighthouse%3A3.1.1.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-08.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-11.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md
- E6: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26.md
- E7: https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-02.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AM-3.md