# Credit without matching token movement

A balance, share, or bid recorded without the matching token transfer, or a transfer result ignored

_Area: DeFi accounting and math bugs. Seen in 67 disclosed reports; one confirmed bounty: $2,000,042; latest 2025-08-17. Updated 2026-10-23._

## How it works
Accounting assumes every credit is backed by a token movement. The bug is a path that records a balance, share, or pool amount without the matching transfer, or moves tokens without updating the tracked balance. The ledger then claims more value than the contract holds, and whoever can withdraw against the inflated figure takes real funds. The invariant that breaks: recorded balance equals tokens actually held or collected, at every exit.

## Where it shows up
- A recorded amount (bid, deposit, pool balance) set from a user-supplied value while the actual pull is a smaller, branch-dependent amount [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-27.md).
- A downstream call that sweeps the contract's whole balance instead of the caller's tracked share [E4](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-06.md).
- Two contracts tracking the same balance where one side clamps by allowance/min() and the other does not [E2](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-07.md).
- Cross-chain or two-step flows where the destination recomputes amount from an unvalidated share, ignoring what was debited on the source [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-14.md).
- A withdrawal that pays out without burning shares or reducing pool accounting [E6](https://bugbountylibrary.com/r/dhl%3A20250817-autopooledtradingbot.md).
- A view-only "try" variant called where the state-mutating variant was needed, so balances never decrement [E5](https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-6.md).
- A cancel/reverse path that restores user-facing state but not the internal buffer variable [E7](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md).
- A public buyFor/onBehalfOf that pulls tokens via allowance and mutates the target's accounting without consent [E8](https://bugbountylibrary.com/r/dhl%3A20250618-bankrollstackplus.md).

## How to review
For each state variable representing value owed, find every write and confirm a matching token movement (or its reversal) exists on the same path. Grep balance writes and transfer calls, then pair them per path. Check that the amount collected equals the amount recorded [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-27.md), that sweeps use tracked per-user amounts [E4](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-06.md), that credit and debit paths apply the same clamp [E2](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-07.md), that destination-side recomputation is bound to the source debit [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-14.md), that every payout burns shares or decrements accounting [E6](https://bugbountylibrary.com/r/dhl%3A20250817-autopooledtradingbot.md), that mutating variants are used wherever balances must change [E5](https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-6.md), that cancel paths symmetrically restore internal buffers [E7](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md), and that allowance-pulling entry points require the target's consent [E8](https://bugbountylibrary.com/r/dhl%3A20250618-bankrollstackplus.md). This differs from reentrancy (ordering) and double-counting (same tokens counted twice): here a single credit simply has no token behind it. False positive: fee-on-transfer or rebasing tokens legitimately make held balance differ from nominal; confirm the code measures actual received amounts rather than flagging the difference itself. A min()/allowance clamp is correct when both credit and debit sides apply it [E2](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-07.md).

## Variants seen
- Recorded bid exceeds amount pulled on lien branch [E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-27.md).
- Shared custody swept by a competing proposal [E4](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-06.md).
- Allowance clamp on debit side only, inflating position [E2](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-07.md).
- Unvalidated share forwarded cross-chain [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-14.md).
- Payout without burning shares, enabling double withdrawal [E6](https://bugbountylibrary.com/r/dhl%3A20250817-autopooledtradingbot.md).
- View-only variant leaves balances stale [E5](https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-6.md).
- Cancel path fails to restore internal buffer [E7](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md).
- Allowance-pulling buyFor inflates dividends without consent [E8](https://bugbountylibrary.com/r/dhl%3A20250618-bankrollstackplus.md).

## Impact and severity
Direct theft or drainage of vault, auction, or staking funds, or bad debt pushed to insurance funds [E1](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-14.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-07.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-27.md)[E4](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-06.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-6.md)[E6](https://bugbountylibrary.com/r/dhl%3A20250817-autopooledtradingbot.md)[E7](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md)[E8](https://bugbountylibrary.com/r/dhl%3A20250618-bankrollstackplus.md). Severity is high where the inflated figure is withdrawable in the same transaction; worse when the gap is silent and only surfaces at withdrawal time.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-14.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-07.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AH-27.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-06.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-08-cork-protocol%3AH-6.md
- E6: https://bugbountylibrary.com/r/dhl%3A20250817-autopooledtradingbot.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-01.md
- E8: https://bugbountylibrary.com/r/dhl%3A20250618-bankrollstackplus.md