# Duplicate entry pads list to bypass check

Lists or fingerprints validated without duplicate checks; aliased accounts; per-entry payouts against one deposit

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2026-01-20. Updated 2026-10-29._

## How it works
A check trusts a list's shape rather than its contents. The list is validated by a fingerprint (length counter plus combined element hashes), by a uniqueness assumption, or by summing per-entry amounts. When duplicates are allowed, the fingerprint can be reproduced, the same account can be passed twice, or the payout is multiplied. The invariant "each entry is distinct and counted once" is never enforced, so padding the list satisfies the check while changing the real state.

## Where it shows up
- Fingerprints packing a length counter in fixed bits and XORing element hashes: even counts of identical elements cancel, and the counter can wrap [E1](https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AM-02.md).
- Instructions taking several accounts of the same type where callers may pass the same pubkey twice [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AM-3.md).
- Functions iterating caller-supplied parallel arrays (recipients, rates, flags) and paying per element [E3](https://bugbountylibrary.com/r/dhl%3A20260120-synaplogic.md).
- Solvency or uniqueness checks that consume a hash/list without a seen-set or explicit duplicate rejection.

## How to review
- For any fingerprint: confirm duplicates are rejected before hashing, or that the scheme is collision-resistant under repeated elements (no XOR cancellation, no counter overflow).
- For multi-account instructions: require distinct pubkeys for accounts whose state is written, or merge writes into one copy [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AM-3.md).
- For per-entry payouts: verify the sum of all entries is bounded by the amount actually received, not by array length [E3](https://bugbountylibrary.com/r/dhl%3A20260120-synaplogic.md).
- The property: every validated list has distinct entries, and total outflow equals total inflow regardless of list size.

## Variants seen
- Hash padding via 256 duplicate tokenIds reproducing the stored position hash [E1](https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AM-02.md).
- Account aliasing where the last serialized copy overwrites earlier reserve updates [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AM-3.md).
- Refund multiplier: 20+ self-entries drained 27.6 ETH and 3450 USDC [E3](https://bugbountylibrary.com/r/dhl%3A20260120-synaplogic.md).

## Impact and severity
Bypassed solvency checks [E1](https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AM-02.md), corrupted pool accounting [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AM-3.md), and direct fund drain [E3](https://bugbountylibrary.com/r/dhl%3A20260120-synaplogic.md). Severity rises when the padded list feeds a payout or a solvency gate, since the attacker controls list length and thus the multiplier.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AM-02.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AM-3.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260120-synaplogic.md