# User-inflatable pending total as guard

A user-movable pending or unclaimed total read live as a hard check that blocks callers or settlement

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-08-27. Updated 2026-10-29._

## How it works
A contract reads a pending or unclaimed total as if it were a fixed, honest measure of state, and uses it as a hard guard. But ordinary user actions move that total: creating a redemption, queuing a burn, self-slashing. When the guard reads the value live, a user who can raise it makes the check fail for everyone else, or makes settlement pay out less than owed. The broken assumption is that the pending total is stable and not attacker-influenced; in reality it is user-controlled input used as a gate.

## Where it shows up
- A guard like `require(totalLocked() <= X)` or `require(balance >= pending)` where `pending` is set by user calls [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md).
- External accounting getters (`totalLocked`, `getUnvestedAmount`) read inside invariant checks [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md).
- A slash or penalty payout capped at remaining stake, with the shortfall silently dropped [E2](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.14.md).
- Any value a single user can raise in one transaction that another path reads as a limit.

## How to review
For each hard check, ask: can any user move this value, and in which direction? The invariant that must hold is that a guard's inputs are either fixed for the duration of the call or bounded so user action cannot push them past the threshold. Concretely: trace every external getter used in a `require` back to the functions that write it; if a user-facing call can raise it, the guard is griefable. Prefer snapshotting the value at entry, or excluding pending/unclaimed amounts from the guard, rather than reading it live [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md). For settlement paths, check that total outstanding obligations cannot exceed the pool backing them, and that any shortfall is not socialized to later claimants [E2](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.14.md).

## Variants seen
- Pending redemption total inflated in one block to DoS burn and admin setters [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md).
- Self-inflicted overslash drains own stake so later penalties go unpaid [E2](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.14.md).

## Impact and severity
Outcomes ranged from blocked user and admin functions [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md) to unpaid penalties for later claimants [E2](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.14.md). Severity rises when the guard blocks all users, not just the attacker, and when the inflated value also feeds payout math so value is lost, not just delayed.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260414-saturnprotocol.md
- E2: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.14.md
- E3: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md