# Sentinel resolved before sequential mutation

Max or full-balance sentinel resolved against live state, then reused in a loop that changes that state

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-04-10. Updated 2026-10-29._

## How it works
A sentinel such as `type(uint256).max` (or a "full balance" value) means "whatever is owed right now." The bug appears when that value is resolved against live state at one point (validation, or the first pass over an array) but the same entries are then processed sequentially elsewhere, where each step changes the state the sentinel depended on. The resolved number no longer matches reality, so value is counted twice or credited to the wrong party.

## Where it shows up
- Arrays of (pool, amount) or (denom, amount) entries where one amount is a sentinel or "all".
- A validation loop that reads `getBorrowsOf`/`balanceOf`/live totals, separate from an execution loop that repays or burns.
- Duplicate keys for the same pool/denom in one array.
- A helper that resolves the sentinel once, then a later loop that mutates the same balance.

## How to review
The invariant: any sentinel or full-balance value must resolve to the same quantity at validation and at execution, or be resolved once and carried forward. Check that:
- Sentinel resolution happens inside the same sequential pass that mutates state, or the resolved value is snapshotted and reused.
- Duplicate keys are rejected or merged before processing.
- Per-item helpers receive the single item, not the whole collection.

## Variants seen
- Sentinel `type(uint256).max` resolved at validation, then a prior partial repay shrinks the balance before the max entry executes, double-counting repayment and over-seizing collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AH-2.md).

Adjacent classes (same "stale or wrong quantity" family, different root cause):
- Multicall forwards whole `msg.value` to the first call; `depositOnBehalfOf` consumes the operator's ETH, leaving their own deposit unfunded [E2](https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md).
- Per-coin loop passes the full `amount` slice to `FundCommunityPool` instead of the single coin, double-crediting on multi-denom burns [E3](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-01.md).

## Impact and severity
Excess collateral seized from borrowers [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AH-2.md). Severity is high where the drift moves real assets; worse when duplicates or multi-entry batches are allowed and no per-key dedup exists.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AH-2.md
- E2: https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.3.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-01.md