# Duplicate entries double-count in loops

Caller-supplied lists summed or paid per entry without a uniqueness check

_Area: DeFi accounting and math bugs. Seen in 23 disclosed reports; latest 2026-04-15. Updated 2026-10-23._

## How it works
A function takes a caller-supplied list of tokens, ids, coins, or reserves and credits, pays, or sums once per entry. Nothing enforces that entries are distinct, so repeating one entry makes the same value count twice. The broken assumption is that list membership implies uniqueness; a list is a sequence, and duplicates are legal input. The invariant that must hold: total credited equals the sum over the *distinct* set of entries, each consumed at most once.

## Where it shows up
- Loops that sum per-asset value or pay a balance per array entry, driven by user input [E1](https://bugbountylibrary.com/r/dhl%3A20260415-xlootstaking.md)[E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.1.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AH-01.md)[E5](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-05.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-04.md).
- Validation that checks each entry is allowed but not that entries differ [E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.1.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AH-01.md).
- Per-entry state (e.g. a per-id cursor like nextRedeem) advanced after the loop pays, not before [E1](https://bugbountylibrary.com/r/dhl%3A20260415-xlootstaking.md).
- Set-intersection helpers that check membership and counts but not distinctness [E4](https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-02.md).
- Adjacent shapes (not duplicate lists): a user-controlled count or bound inflating a total [E7](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-20.md); a value already folded into a total added again [E8](https://bugbountylibrary.com/r/c4%3A2024-12-benddao-invitational%3AH-01.md).

## How to review
Find every loop that credits, pays, or sums from a caller-supplied list. Confirm uniqueness is enforced explicitly by a seen-set or a key (e.g. LAUNCHER_ID [E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.1.md), a `seen[addr]` mapping, or a sorted-and-deduped array), not inferred from a per-entry membership check [E3](https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AH-01.md)[E4](https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-02.md). Confirm per-entry state advances before the loop pays [E1](https://bugbountylibrary.com/r/dhl%3A20260415-xlootstaking.md). For position valuation, confirm the key includes the specific tokenId/owner, not just tick range [E7](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-20.md). For liquidation math, confirm an "extra" amount is not already inside the total before adding it again [E8](https://bugbountylibrary.com/r/c4%3A2024-12-benddao-invitational%3AH-01.md).

## Variants seen
- Duplicate NFT IDs in a reward loop multiply claims before the per-id cursor advances [E1](https://bugbountylibrary.com/r/dhl%3A20260415-xlootstaking.md).
- Repeated coin in a treasury list double-counts spent value, bypassing the treasury maximum; on Chia a coin and its output can be spent in the same bundle (chain-specific) [E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.1.md).
- Repeated ERC20 in a governance quit list pays the timelock share multiple times [E3](https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AH-01.md).
- Repeated tokenId satisfies a multi-id NFT order, stealing the price difference [E4](https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-02.md).
- Duplicate orders summed in slippage reimbursement inflate unitsSold [E5](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-05.md).
- Parallel reserve list summed per element, inflating auction bid/lot [E6](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-04.md).
- Adjacent: user-controlled count inflates a reward total [E7](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-20.md); extra amount double-counted in liquidation accounting [E8](https://bugbountylibrary.com/r/c4%3A2024-12-benddao-invitational%3AH-01.md).

## Impact and severity
Outcomes ranged from draining a treasury at a discount [E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.1.md) and multiplying reward claims for 6.21 ETH profit [E1](https://bugbountylibrary.com/r/dhl%3A20260415-xlootstaking.md), to draining governance funds [E3](https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AH-01.md), stealing NFT order price differences [E4](https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-02.md), inflating insurance reimbursement [E5](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-05.md), and inflating auction values [E6](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-04.md). Severity is high where the loop pays real value or gates solvency; worse when the duplicate also bypasses a maximum or minimum check [E2](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.1.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-04.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260415-xlootstaking.md
- E2: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.1.1.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-07-nounsdao%3AH-01.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-02.md
- E5: https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-05.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-04.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-20.md
- E8: https://bugbountylibrary.com/r/c4%3A2024-12-benddao-invitational%3AH-01.md