# Double-debited DeFi accounting

One event reducing a total or balance through two overlapping paths, or a term already reflected in the base

_Area: DeFi accounting and math bugs. Seen in 31 disclosed reports; one confirmed bounty: $1,050,000; latest 2026-10-14. Updated 2026-10-23._

## How it works
One economic event (repay, slash, burn, withdraw, refund, cancel) should reduce a total or balance exactly once. The bug is that two paths each apply the same reduction, or one path applies it to a value that already reflects it. The invariant that breaks: `recorded_total == sum of real obligations`, and `each event debits once`. When the recorded total drifts below reality, whoever claims against the recorded total extracts the phantom difference. A related shape: two functions on the same order each release the same escrow, so one deposit is refunded twice.

## Where it shows up
- A transfer/repay that moves real tokens, followed by a snapshot balance-delta that also decrements the same total [E3](https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AH-01.md).
- A recorded balance updated in the opposite direction of the real transfer.
- A term subtracted from a supply that already reflects a burn [E8](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-01.md).
- A `position_diff` applied by the caller and again inside the validation helper.
- A refund of margin already withdrawn through a separate path [E6](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md).
- Two functions (cancel, modify) each releasing the same escrow without invalidating order state [E7](https://bugbountylibrary.com/r/dhl%3A20250720-stepp2p.md).
- A pooled share counter debited by both release and cancel for the same position [E1](https://bugbountylibrary.com/r/dhl%3A20261014-uncxsmarttokenvesting.md).
- A snapshot decremented on a path where the asset never moved; a direct donation flips the branch [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-belt-finance-logic-error-bugfix-review-largest-ever-bounty-payout.md).
- A status predicate using a different boundary than the event scheduler, so one event is processed twice [E4](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AH-2.md).

## How to review
For every state update, trace the real token/position movement and confirm the recorded total moves once, in the same direction. Check: does any helper apply a diff the caller already applied? Does a snapshot delta overlap a transfer that already reduced the balance? Is a subtracted term already inside `totalSupply`? Do two functions on the same ID each release escrow? Does a status check use the same boundary as the scheduler that fires the event [E4](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AH-2.md)? The property: each event debits the global denominator exactly once, and recorded balance equals real balance after every path.

## Variants seen
- Slash transfer plus balance-delta snapshot both decrement totalAssets [E3](https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AH-01.md).
- Margin refunded after already withdrawn [E6](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md).
- Cancel and modify both refund same order [E7](https://bugbountylibrary.com/r/dhl%3A20250720-stepp2p.md).
- Pooled share counter debited by release and cancel [E1](https://bugbountylibrary.com/r/dhl%3A20261014-uncxsmarttokenvesting.md).
- Snapshot decremented without asset movement; donation flips branch [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-belt-finance-logic-error-bugfix-review-largest-ever-bounty-payout.md).
- Burn already in totalSupply subtracted again [E8](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-01.md).
- Boundary mismatch double-processes one event [E4](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AH-2.md).

## Impact and severity
High: locked ETH [E3](https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AH-01.md), fund drain [E6](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md)[E7](https://bugbountylibrary.com/r/dhl%3A20250720-stepp2p.md), pooled-token drain [E1](https://bugbountylibrary.com/r/dhl%3A20261014-uncxsmarttokenvesting.md), excess shares [E2](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-belt-finance-logic-error-bugfix-review-largest-ever-bounty-payout.md), overpaid emissions [E8](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-01.md), chain halt via panic [E4](https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AH-2.md). Worse when the drift is claimable by an attacker or a flash loan amplifies it.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20261014-uncxsmarttokenvesting.md
- E2: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-belt-finance-logic-error-bugfix-review-largest-ever-bounty-payout.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-07-karak%3AH-01.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-12-babylon%3AH-2.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-3.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md
- E7: https://bugbountylibrary.com/r/dhl%3A20250720-stepp2p.md
- E8: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-01.md