# Stored value recomputed from live params

Exit-time recomputation of a stored amount from current config instead of the value recorded at entry

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-06-02. Updated 2026-10-29._

## How it works
A financial quantity is recorded when an action happens (a deposit time, a funded buffer, a tax paid). Later, at settlement, cancel, or redeem, the contract does not read that recorded value back. It recomputes the amount from whatever governance parameters or pool state are live at exit time. The assumption that breaks: that the parameters in force at exit equal those at entry. When they differ, the recomputed number no longer matches what was actually paid or owed, so the contract reverts, mispays, or credits the wrong party.

## Where it shows up
- Exit paths (cancel, redeem, settle, relist) that call a getter like `getBufferAmountByFlowRate` or a tax resolver instead of reading a stored field.
- Wrapper or manager contracts that mirror pool accounting and re-derive fields the underlying library already computes.
- Governance-tunable inputs (minimum deposit, liquidation period, fee rates) feeding a calculation on a position funded earlier.
- State flags (liquidation, bankruptcy) that change how an object was created, with downstream functions that ignore the flag.
- Refund or credit logic keyed on an owner rather than on who actually paid.

## How to review
For each stored financial quantity, find where it is written and where it is read. The invariant: any amount settled at exit must equal the value captured at entry, or be derived only from immutable per-position data. Flag any exit-time recomputation from live config. Compare wrapper bookkeeping field-by-field against the underlying library's logic (e.g. deposit time should use max of source and destination, reset past bankruptcy) [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-02.md). Check that every function assuming a normal creation path also handles the flagged path [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-16.md).

## Variants seen
- Copying a source position's timestamp to a destination, ignoring the destination's bankruptcy time, permanently freezing shares [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-02.md).
- Recomputing a funded buffer from current governance config at cancellation, causing revert or misaccounting [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AM-3.md).
- Relisting a liquidated listing without a liquidation check, refunding tax the owner never paid [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-16.md).

## Impact and severity
Permanent freezing of LP funds [E1](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-02.md), cancellation reverts or wrong accounting [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AM-3.md), and protocol fund drain via refunds to non-payers [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-16.md). Severity rises when the wrong value is unrecoverable (frozen funds) or repeatable (drainable refunds).

## Why fixes fail
Fixes that patch one exit path leave sibling paths recomputing the same quantity; the durable fix is to persist the entry-time value and read it everywhere.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-02.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-06-superfluid-locker-system%3AM-3.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-16.md