# Requested vs measured amount accounting

Helpers returning input amount instead of measured delta; approvals, fees, shares, or allowances computed from the wrong unit

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-08-20. Updated 2026-10-24._

## How it works
A contract records or charges a value derived from the *requested* amount (the number passed in) rather than the *measured* result (what actually moved, was pulled, or was minted). The two agree only when the conversion factor is 1 or rounding is exact. When price-per-share, an index, or a fee differs, the stored number drifts from reality: collateral is overstated, approvals are short, or allowance is under-charged. The broken assumption is "input units equal output units." The invariant that must hold: every value written to state or charged to a user equals the measured delta of the underlying asset or shares, not the requested input.

## Where it shows up
- A helper whose docstring promises a derived unit (shares) but returns the input unit (amount) [E1](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-02.md).
- Callers that store a helper's return value directly as accounting state (collateral, balances).
- `safeApprove`/allowance set to the nominal transfer amount while a third-party adapter pulls amount+fee [E2](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-9.md).
- Allowance decremented in nominal units while balance moves in scaled/index units with ceiling rounding [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-42.md).

## How to review
For every value written to state or charged to a user, trace where it comes from. Check:
- Does the helper return the actual received amount (balance delta or minted shares), or echo its argument? [E1](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-02.md)
- Does the approval/allowance cover the exact amount the callee will pull, including fees? [E2](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-9.md)
- Are allowance units and balance units the same, and does rounding direction match the charge? [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-42.md)

## Variants seen
- Return-value unit mismatch: helper returns amount, caller stores as shares; breaks when pps != 1 [E1](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-02.md).
- Approval shortfall: fee added on top of approved amount, so every call reverts [E2](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-9.md).
- Rounding/unit mismatch: ceiling division on dust lets each call move a full share while charging nominal allowance [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-42.md).

## Impact and severity
Consequences ranged from blocked operations (rebalance reverts [E2](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-9.md)) to fund loss and stuck collateral blocking cancelPool and liquidation [E1](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-02.md), to moving more value than approved [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-42.md). Severity rises when the drift is silent (no revert) and compounds across calls, and when it touches collateral or liquidation paths where overstatement cannot be corrected.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-02.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-9.md
- E3: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-42.md