# Paused-state accounting and fee accrual bugs

Early returns, zero-amount calls, and time-based accrual that ignore pause or disabled state

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-07-07. Updated 2026-10-23._

## How it works
A pause or disable flag is meant to freeze one action, but the code around it assumes the frozen action is a harmless no-op. Three assumptions break: (1) a netting deposit/withdraw pair cancels, but an early return on one leg leaves the other leg moving real tokens; (2) a zero-amount downstream call is free, but it still hits a `whenNotPaused` guard and reverts the whole path; (3) time-based fees accrue from `block.timestamp` regardless of whether users could act. In each case bookkeeping diverges from reality: fees are paid from the wrong balance, repay/liquidation is blocked, orders stay live, or users are charged for a window they could not trade.

## Where it shows up
- Netting logic (deposit/withdraw, commit/trim) with early returns on `maxWithdraw()==0`, `amount==0`, or silent `withdraw` no-ops [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-3.md)
- Zero-amount calls to external contracts that carry `whenNotPaused` or similar guards [E2](https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-4.md)
- Cancel/refund paths that transfer collateral in the same transaction as cancellation [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-12.md)
- Time-based accrual (funding, borrow, interest, rewards) computed from timestamps without checking pause/disable flags [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-19.md)
- Emergency flags that block creation/execution but not accrual or refund

## How to review
For every pause/disable flag, enumerate the actions it should and should not block, then trace each allowed path for downstream calls that hit the guard. The invariant: a paused state must not change balances, must not block the actions the design intends to keep open, and must not accrue fees users cannot avoid. For netting, verify every early-return path leaves both legs consistent so no real token moves from contract-held funds [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-3.md). For accrual, confirm the fee clock excludes paused windows [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-19.md).

## Variants seen
- Netting broken by vault pause, paying users from protocol fees [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-3.md)
- Zero-amount borrow reverting repay/liquidation on paused asset [E2](https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-4.md)
- Cancel reverting on paused collateral, leaving order live [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-12.md)
- Fees accruing while position decrease disabled [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-19.md)

## Impact and severity
Loss of protocol-held funds [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-3.md), blocked liquidation and bad debt [E2](https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-4.md), free options on price direction [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-12.md), unfair liquidation of users [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-19.md). Severity rises when the pause is attacker-triggerable or front-runnable [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-12.md) and when funds move rather than just revert [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-3.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AM-3.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-07-cap%3AM-4.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-12.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-19.md