# Liquidation reward wrong base accounting

Reward or loss math using principal or stale cached allocation instead of interest-inclusive debt

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-11-05. Updated 2026-10-24._

## How it works
A reward, penalty, or loss is computed from a base that is not the same base the rest of the system uses. The assumption that breaks: that the value passed into the reward/loss formula equals the true economic amount. In practice the true amount accrues interest or includes donated/stray balances, while the input is principal-only or a cached allocation updated only on discrete events. The formula then returns a number that is internally consistent but wrong relative to solvency math.

## Where it shows up
- Reward/loss functions fed `userBorrowPart` (principal) while solvency checks use `totalBorrow.elastic` (interest-inclusive) [E3](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-21.md)
- Loss computed as `allocation() - previewRedeem(shares)` where `allocation` only moves on allocate/deallocate but `_totalAssets` accrues continuously [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.2.md)
- Strategy deposits that pull tokens from a shared contract balance without validating against the accounted `collateral[holding]` variable [E2](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md)
- Any cached per-adapter or per-user figure whose update cadence differs from the aggregate it is compared against

## How to review
The invariant: every reward, penalty, loss, and collateral figure must be derived from the same interest-inclusive, fully-accounted base used by solvency and pricing math. Check each call site of the reward/loss formula and trace its input back to source. Compare update frequency of aggregate state (`_totalAssets`, `elastic`) against cached values (`allocation`, `collateral`). For strategy deposits, confirm the amount pulled is bounded by the accounted variable, not the raw token balance.

## Variants seen
- Principal-only debt passed to a dynamic incentive curve, overpaying liquidators [E3](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-21.md)
- Stale cached allocation excluding accrued interest, understating loss and inflating `_totalAssets` [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.2.md)
- Donated/stray tokens invested but never added to collateral accounting, hiding collateral from bad-debt liquidation [E2](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md)

## Impact and severity
Overpaid liquidator rewards shortchange the protocol [E3](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-21.md); inflated `_totalAssets` misprices deposits and withdrawals [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.2.md); hidden collateral lets owners shield funds from bad-debt seizure [E2](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md). Severity rises where a monotonic incentive curve amplifies a smaller input, or where the stale cache diverges further the longer interest accrues.

## Why fixes fail
No fix evidence provided.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Amorpho_jul2025%3A3.1.2.md
- E2: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.11.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-21.md