# Double-counted amount in weight or revenue

Same amount added to stored total and passed again as an 'additional' input to weight or revenue math

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2024-06-24. Updated 2026-10-24._

## How it works
A value is recorded in persistent state (a total, a fee-revenue accumulator, a balance) and then the same value is handed again to a calculation that re-reads or re-adds that state. The assumption that breaks is "this input is new information." When the callee already sees the updated total, the extra parameter counts the amount a second time, so weight, revenue or balance is inflated relative to reality. A sibling shape: a helper's transfer destination changes, but a downstream call still pulls the same tokens from the user, so one deposit is charged twice while only one is recorded [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-31.md).

## Where it shows up
- A function that both persists an amount (AddTopicFeeRevenue, increaseReserve, _addCollateral) and passes the same amount as an `additional...` argument to a weight/score/accounting call [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-11.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-32.md).
- Callees whose parameter name (`additionalRevenue`) does not match what callers actually pass (stake amount) [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-32.md).
- Accounting formulas like `_accountedBalance()` derived from observations minus withdrawals, with separate manual injection paths that bypass them [E2](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-08.md).
- Helper contracts that transfer output to `msg.sender` (the market) while the caller still pulls tokens from the user [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-31.md).
- Any invariant of the form "token balance == accounted components"; trace every path that moves tokens.

## How to review
For each amount, follow it end to end and ask: is it written to state, and is it also passed into a calculation that reads that state? The invariant: each unit of value must enter the total exactly once. Check that `additional` parameters carry genuinely new value, not a value already persisted; that every token-moving path (manual reserve/liquidity injection, helper transfers) updates the accounted-balance formula; and that when a transfer destination changes, no downstream call still pulls from the original payer. Compare parameter names against caller arguments and units.

## Variants seen
- Persist-then-pass-again into weight: FundTopic [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-11.md), AddStake passing stake as revenue [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-32.md).
- Accounting formula blind to a manual injection path: increaseReserve vs _accountedBalance [E2](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-08.md).
- Double-pull after refactor: getCollateral sends to market, _addCollateral pulls from user again [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-31.md).

## Impact and severity
Premature topic activation below the global minimum [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-11.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-32.md), reserve funds stealable via double-counted contributions [E2](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-08.md), and silent double-charging of users [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-31.md). Severity rises where the inflated value gates activation or unlocks shared funds, and where the mismatch is invisible because types and units match.

## Why fixes fail
No fix evidence in these reports.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-31.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-08.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-11.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AM-32.md