# Interest accrued after state change

Debt, rate or term mutated before interest accrual, so interest is double-counted, skipped or mispriced

_Area: DeFi accounting and math bugs. Seen in 45 disclosed reports; latest 2026-10-17. Updated 2026-10-23._

## How it works
Interest accounting assumes a stored amount and its timestamp are consistent: the amount reflects the last accrual, and the timestamp marks when that accrual happened. The bug is ordering, and it takes two distinct shapes. **Double-count:** code refreshes a stored amount to include interest, then a downstream rate/slope function recomputes interest over the same period because the timestamp is still stale. **Missing recompute:** code changes a rate, term, or utilization input and then recomputes interest against the old or new value inconsistently, so a position accrues nothing, accrues retroactively, or accrues at the wrong rate. Either way bookkeeping drifts from reality.

## Where it shows up
- A stored debt/amount is set to an "owed" value (interest included) while its timestamp is still stale, then a slope/rate function runs [E2](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-1.md).
- A rate/index is recomputed from cached debt shares *before* the repay/withdraw mutation lands [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-10.md).
- A utilization input (e.g. floatingBackupBorrowed) is updated without first accruing pending interest [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-5.md).
- A settlement/close path snapshots debt via a compounding factor while a time-based penalty is still pending [E5](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AH-01.md).
- Time-derived state updated outside the epoch gate, or accrual not scaled by elapsed time [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-13.md)[E7](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-11.md).
- A rate oracle returns 0 past a deadline, discarding interest accrued but not checkpointed [E8](https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.1.md).
- Grep cue: setters of debt/amount/rate followed by slope/index/interest calls; `updateInterestRates` before `repay`/`withdraw`.

## How to review
For every mutation of a debt, rate, or term, trace the order: is interest accrued to now *before* the amount changes, and is the timestamp advanced in the same step? Check the invariant that each accumulator (slope, debt, index) is decremented with old terms and incremented with new terms exactly once per position change [E2](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-10.md). For utilization inputs, confirm pending interest is accrued before the input moves [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-5.md). For time-based accrual, verify the formula is proportional to elapsed time and path-independent (N small steps equals one large step) [E7](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-11.md). For deadline-gated rates, confirm pre-expiry interest is checkpointed [E8](https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.1.md).

## Variants seen
- Double-count: amount refreshed with interest, then slope recomputed over stale timestamp [E2](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-1.md).
- Rate recomputed from pre-mutation debt shares [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-10.md).
- Utilization input moved without prior accrual [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-5.md).
- Settlement snapshot ignores pending time-based penalty [E5](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AH-01.md).
- Intra-epoch compounding from mismatched gating [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-13.md).
- Non-time-proportional accrual [E7](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-11.md).
- Deadline-gated rate discards unaccrued interest [E8](https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.1.md).

## Impact and severity
LPs lose funds and vault share value is impaired [E2](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-1.md); debt is mispriced and users face unfair liquidation [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-10.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-5.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-13.md)[E7](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-11.md); borrowers escape penalties absorbed by the last lender [E5](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AH-01.md); depositors lose earned yield [E8](https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.1.md). Severity rises when drift is silent and compounds across calls, and when it blocks repayment or liquidation.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20261017-bifi.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-10.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-5.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AH-01.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-13.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-11.md
- E8: https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.1.md