# Commingled reserves across share classes

One balance or reserve variable serving LP shares, synth deposits, or fee buckets, so one class drains another

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2026-02-05. Updated 2026-11-02._

## How it works
A contract keeps a single raw balance or reserve variable and lets several claims draw on it: LP share value, synth-minted deposits, accrued protocol/launchpad fees, or incentive funds. The assumption that breaks is that every path which increases the shared variable also issues the matching claim, and every path which pays out measures against the same basis. When one path credits value without issuing shares, or pays out from a balance that includes another bucket, the classes silently share each other's money and the first to exit takes the difference [E2](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md)[E3](https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident-2%3AM-06.md)[E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03.md).

## Where it shows up
- A reserve variable updated by more than one deposit path, where only some paths mint shares [E2](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md)
- `mint()` reading reserves while `burn()` reads raw balances (or vice versa) [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03.md)
- Swap input inferred from balance deltas while reserves are stored net of a fee bucket [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md)
- A `collect()`/payout path drawing from the same token balance that holds incentives or fees [E3](https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident-2%3AM-06.md)
- Fork-added fee buckets (protocol/launchpad fees) that live in balances but not reserves [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md)[E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03.md)

## How to review
For every variable that represents a pool's holdings, list every writer and every reader. The invariant: any path that increases a shared reserve must mint the corresponding claim, and any payout must be computed on the same basis (net or gross) as the deposit that funded it. Check that fee/incentive buckets are excluded from LP payout math and from swap input inference. Diff `mint` vs `burn` vs `swap` accounting basis line by line [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md)[E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03.md).

## How finders spotted it
- Compared `_update` reserve accounting against swap's amountIn inference; saw reserves exclude launchpad fees while balances include them [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md)
- Noticed synth mint bumps `reserveNative` but issues no LP shares, while LP mint/burn uses that same variable [E2](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md)
- Saw `collect()`'s balance check and `_transfer` use the same bento balance that holds incentive deposits [E3](https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident-2%3AM-06.md)
- Diffed `mint()` (reserves) against `burn()` (balances) and found the fee mismatch [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03.md)

## Variants seen
- Phantom swap input from fee-inflated balances [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md)
- Synth deposits donated to LP share value [E2](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md)
- Incentives consumed as fee liquidity [E3](https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident-2%3AM-06.md)
- LP burn over-payment from fee-inclusive balances [E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03.md)

## Impact and severity
Loss of user funds: synth minters' USDV drained by exiting LPs [E2](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md); incentives unclaimable [E3](https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident-2%3AM-06.md); pair liquidity drained [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md)[E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03.md). Impact scales when the exploit loops in one transaction, compounding a small mispricing into draining the whole balance [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md)[E4](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident-2%3AM-06.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03.md