# Stale checkpoint interest accrual

Interest math using a timestamp, rate, or balance not refreshed at the interval boundary

_Area: DeFi accounting and math bugs. Seen in 6 disclosed reports; latest 2026-10-17. Updated 2026-10-24._

## How it works
Interest is the integral of a rate over time. These bugs replace the integral with one multiplication: a stored gap or elapsed time times a rate. The assumption that breaks is that the rate, balance, or timestamp in that product is the one that actually applied over the interval. When an input is stale, frozen, or recomputed from live totals at the wrong moment, the product no longer equals interest owed. The error is silent: balances look plausible, and only the direction of drift reveals it.

## Where it shows up
- A stored idle block gap multiplied by a rate recomputed from live deposit/borrow totals [E1](https://bugbountylibrary.com/r/dhl%3A20261017-bifi.md)
- Accrual gated on a rate-change threshold while `totalAsset`/`totalBorrow` only refresh on interaction [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-4.md)
- `block.timestamp` used where a loan end time was intended [E3](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AM-16.md)
- A batch expiry timestamp passed to accrual instead of payment time [E4](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-01.md)
- A live, state-dependent rate (e.g. `borrowRatePerBlock`) multiplied by elapsed blocks as if constant [E5](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-07.md)
- Per-call rate updates inside an epoch that only advances on `deltaTime>0` [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-13.md)

## How to review
For every interest or share computation, identify the exact interval and the rate that applied over it. Invariant: interest charged must equal the integral of the rate actually in force across the elapsed interval, and every input must be refreshed at the same checkpoint as the interval boundary. Concretely, check which timestamp accrual receives: the business event time (payment, processing), not expiry or now [E3](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AM-16.md)[E4](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-01.md). Check that a gate skipping accrual does not also skip refreshing its own inputs [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-4.md). Check that a rate assumed constant is genuinely constant over the interval, or that accrual is incremental [E5](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-07.md). Check that all time-derived state is gated by the same epoch-advance condition [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-13.md).

## Variants seen
- Frozen idle gap re-applied per same-block action at attacker-set utilization [E1](https://bugbountylibrary.com/r/dhl%3A20261017-bifi.md)
- Rate-change gate skipping legitimate accrual on stale totals [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-4.md)
- Wrong end timestamp inflating tranche repayment past a creation-time bound [E3](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AM-16.md)
- Expiry timestamp truncating interest owed to a withdrawal batch [E4](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-01.md)
- Current dynamic rate applied retroactively over the whole borrow duration [E5](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-07.md)
- Intra-epoch rate updates compounding against a stale epoch reference [E6](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-13.md)

## Impact and severity
Direct fund loss: E1 drained ~165,574 USDT. Others cause systematic over- or under-payment of interest and rewards, mispriced debt, and broken repayment bounds. Severity rises when the trigger is permissionless and repeatable within one block or transaction, and when drift compounds across calls.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20261017-bifi.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-4.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AM-16.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-01.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-07.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-13.md