# Self-inclusive amount guard reverts

Guards comparing an amount to a total that already includes it, or to balances skewed by external transfers

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
A validation check is meant to bound a value, but the value being checked is already part of the total it is compared against. The comparison then can never be satisfied once any other component (fee, interest, prior balance) is nonzero, so valid operations revert. The broken assumption is that the compared total is independent of the amount; in reality the total is a superset that re-includes it.

## Where it shows up
- A guard of the form `if (amount < totalAmount) revert` where `totalAmount = amount + fee + interest` or similar.
- Minimum/slippage amounts derived from the contract's own token balances rather than the pool's reserve ratio.
- Functions that cache storage structs into memory locals and write them back, where two keys can alias (from == to, same id).
- Any check whose right-hand side is computed by summing the left-hand side with other terms.

## How to review
For each amount check, identify every term in the compared total and confirm the checked amount is not one of them. The invariant: the guard's threshold must be a function of quantities independent of the value under test. For slippage, confirm minimums come from pool reserves, not contract balances. For memory-cache writebacks, confirm distinct keys or an explicit `from != to` guard so the later write cannot clobber the earlier mutation.

## Variants seen
- Self-inclusive total: `amount` compared to `amount + fee + interest`, always tripping on accrued interest [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.3.md).
- Balance-derived slippage minimums: min amounts set to 95% of contract balances, skewed by external transfers [E2](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-27.md).
- Aliased writeback: self-transfer overwrites the decremented balance with the incremented one, minting unbacked notional [E3](https://bugbountylibrary.com/r/c4%3A2021-09-swivel%3AH-03.md).

## Impact and severity
Core functionality breaks: partial repayments revert [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.3.md), liquidity adds are griefable [E2](https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-27.md), and self-transfers mint unbacked notional, a direct accounting corruption [E3](https://bugbountylibrary.com/r/c4%3A2021-09-swivel%3AH-03.md). Severity rises when the broken path is on a core flow or when external actors can trigger the skew cheaply.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.3.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-27.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-09-swivel%3AH-03.md