# Stale or unregistered reward weight inflation

Weight or capital counted before registration or after expiry, inflating totals and diluting or over-charging others

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2023-02-01. Updated 2026-11-02._

## How it works
Accounting totals (reward weight, locked capital, leverage ratios) are kept in stored sets or counters that are only pruned or registered lazily. A function that reads or increments those totals without first running the pruning/registration step counts entries that should not be there — expired protections, or gauges never added. The total drifts above reality, so everyone sharing that total is diluted or over-charged.

## Where it shows up
- Functions iterating a stored `active...Indexes` set without calling the expiry/accrual routine first [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-1.md)
- Permissionless increment/decrement functions whose only guard is a `deprecated` set, not membership in the active set [E2](https://bugbountylibrary.com/r/c4%3A2022-04-xtribe%3AM-04.md)
- State-mutating functions that reduce one variable feeding a ratio but not its partner (e.g. capital down, protection count unchanged) [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-4.md)
- Inner calculations that re-derive principal or weight without their own expiry/membership check [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-1.md)

## How to review
For each total, ask: which routine prunes or registers its members, and does every reader/incrementer call it? The invariant: a total must equal the sum over currently-valid, registered entries at the moment it is used. Check ordering — can a permissionless call land before the admin's registration call and corrupt the total [E2](https://bugbountylibrary.com/r/c4%3A2022-04-xtribe%3AM-04.md)? Check ratio inputs: every mutating path must update all variables feeding the ratio consistently [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-4.md).

## How finders spotted it
- Noticed `lockCapital()` never calls the expiry routine other flows use, and the inner principal calc also lacks an expiry check [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-1.md)
- Saw the `incrementGauge` guard only excludes deprecated gauges, then tested incrementing before `addGauge` and observed double-counting [E2](https://bugbountylibrary.com/r/c4%3A2022-04-xtribe%3AM-04.md)
- Read `lockCapital()` against the leverage ratio: capital decreased but protection count not, so locked-capital protections are counted twice [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-4.md)

## Variants seen
- Stale expired entries left in an active set, over-locking capital and funding expired defaults [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-1.md)
- Weight added before registration, double-counted in the global total [E2](https://bugbountylibrary.com/r/c4%3A2022-04-xtribe%3AM-04.md)
- Ratio double-counting because one side of the ratio is updated and the other is not [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-4.md)

## Impact and severity
Sellers lose more capital than owed and expired defaults get funded [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-1.md); reward allocations are diluted across inflated weight, reachable permissionlessly by frontrunning the admin [E2](https://bugbountylibrary.com/r/c4%3A2022-04-xtribe%3AM-04.md); protection becomes over-priced or unbuyable despite a well-capitalized pool [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-4.md). Impact rises with permissionless reachability [E2](https://bugbountylibrary.com/r/c4%3A2022-04-xtribe%3AM-04.md) and with how many users share the corrupted total.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-1.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-04-xtribe%3AM-04.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AM-4.md