# Missing minimum and dust threshold checks

Guards on minimum payout or position size that partial fills, splits, or threshold switches can bypass

_Area: DeFi accounting and math bugs. Seen in 5 disclosed reports; latest 2024-02-15. Updated 2026-10-23._

## How it works
A contract promises a floor: a position stays above a minimum quote value, a recipient gets at least a minimum payout, a deposit is added at a sane ratio. The floor is enforced by a check that keys on the wrong quantity or is skipped on one path. When the path taken differs from the one the check was written for (full-close request that partially fills, a split that switches formula above a threshold, a deposit that forwards raw balances), the floor is never applied and the result is dust, underpayment, or a skewed deposit.

## Where it shows up
- A `require` on a minimum gated by a condition like `requestedQuantity != amountToClose`, so a full-close request skips it [E1](https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-3.md)
- Payout logic that switches from equal-split minimum to proportional split once a total threshold is crossed [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-kairos%3AM-4.md)
- Slippage minimums computed from the contract's own token balances instead of pool reserves [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-27.md)
- Deposit paths that forward entire token balances to an AMM without ratio checks [E4](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-04.md)
- Any split, partial-fill, or batch path that reuses a check written for the whole-amount path

## How to review
Identify the invariant the floor is meant to guarantee (minimum position value, minimum per-recipient payout, proportional deposit). Then check the guard compares against the actual settled amount, not the requested amount: it must key on `filledAmount`/actual payout, not `quantityToClose` [E1](https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-3.md). For threshold-switching formulas, verify continuity at the boundary — no recipient falls below the guaranteed minimum on either side [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-kairos%3AM-4.md). For deposits, confirm amounts are derived from pool reserve ratios, not raw balances [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-27.md)[E4](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-04.md).

## Variants seen
- Full-close request partially filled, leaving dust below minimum [E1](https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-3.md)
- Proportional split above a threshold paying some recipients below the guaranteed minimum [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-kairos%3AM-4.md)
- Slippage minimums from own balances, griefable by external transfer [E3](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-27.md)
- Raw-balance deposit into a stableswap pool minting fewer LP tokens [E4](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-04.md)

## Impact and severity
Dust positions below minimum, underpaid recipients, forced reverts, and value capture via arbitrage on skewed deposits. Severity rises when the bypass is externally triggerable (token transfer, partial fill) and when the loss is silent rather than a revert.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-3.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-02-kairos%3AM-4.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-27.md
- E4: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-04.md