# Nominal amounts on rebasing tokens

Stored fixed token amounts instead of shares on rebasing or elastic tokens, drifting from real balance

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-02-05. Updated 2026-10-29._

## How it works
A rebasing or elastic token (stETH, aTokens, Blast WETH) changes every holder's balance without transfers. The protocol's real balance moves, but any stored number stays fixed. The assumption that breaks: "the amount I recorded equals the balance I hold." Once the token rebases, stored amounts and actual reserves diverge, so claims, contributions, or share math no longer match reality.

## Where it shows up
- Withdrawal or claim queues that store a token amount (e.g. `amountToRedeem`) rather than shares [E1](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md)
- Transfers done via `IERC20.transfer` on a share-based token, ignoring the share/amount distinction [E1](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md)
- Functions that treat any unaccounted balance delta as a user contribution or deposit [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-2.md)
- Contracts on chains where tokens default to automatic/rebasing yield mode [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-2.md)
- Share accounting reduced by raw transfer amount without tracking token provenance [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-25.md)

## How to review
The invariant: for every stored position, the protocol must be able to convert it to the exact real balance it represents at claim time. Check whether accounting is denominated in shares (or a rate-adjusted unit) and converted on read, not frozen at write time. For rebasing chains, confirm the contract's yield mode is explicit (e.g. claimable, not automatic) and that no function credits balance deltas to a caller. For share/stake hooks, verify reductions are keyed to the origin of the tokens moved, not just the transfer amount [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-25.md).

## Variants seen
- Fixed withdrawal amount on stETH, so early claimers dodge slashing losses and later claims revert [E1](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md)
- Auto-rebasing WETH yield captured as a vault contribution, inflating winning odds [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-2.md)
- Transfer hook subtracting full amount from bonding shares, wiping a holder's original shares after a two-hop transfer [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-25.md)

## Impact and severity
High: insolvency and unfair distribution of reserves [E1](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md), manipulation of prize odds via stolen yield [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-2.md), and loss of fee-sharing rights [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-25.md). Severity rises when the drift is claimable by an attacker (E2) or compounds across many users (E1).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-25.md