# Settlement path skips invariant recheck

Every path that moves funds or removes deposits must re-run the pool's final-state invariant check

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2024-07-25. Updated 2026-10-29._

## How it works
A pool enforces a core invariant (LUP >= HTP, reserve ratio, up-to-date lender accounting) on its normal paths. A second path — kick-with-deposit, buyout settlement, market-making order placement — moves funds or removes deposits but never re-validates the invariant afterward. The assumption that "all fund-moving paths end with the same guard" is false, so the pool can settle into a state the invariant forbids.

## Where it shows up
- A function that removes deposits or pays lenders but does not call the same post-condition check as the canonical path (e.g. `removeQuoteToken`).
- Settlement variants (repay, liquidate, buyout) where only some invoke the lender's accounting hook (`loanLiquidation`/`loanRepayment`).
- Invariant guards called only before external calls that withdraw funds, with no re-check after.
- Direct transfers to lenders that bypass the pool's queue/outstanding-value update.

## How to review
Enumerate every path that mutates the shared invariant or moves funds to a lender. For each, confirm the final-state check runs after the mutation, not just before. The property: after any deposit removal, settlement, or liquidity deployment, the pool's invariant (LUP >= HTP, reserve ratio, outstanding balances) holds and the lender accounting hook has fired. Diff each path's post-conditions against the canonical one; a missing guard is the bug.

## Variants seen
- Deposit removal without LUP >= HTP check, freezing deposit ops [E1](https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-2.md).
- Buyout settlement repaying lenders directly, skipping `loanLiquidation`, leaving pool accounting stale and shares mispriced [E2](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-06.md).
- Reserve-ratio check only before order placement, never after funds leave [E3](https://bugbountylibrary.com/r/c4%3A2022-05-rubicon%3AH-08.md).

## Impact and severity
High: broken core invariant freezes deposit operations [E1](https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-2.md); stale accounting misprices shares [E2](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-06.md); LPs left illiquid [E3](https://bugbountylibrary.com/r/c4%3A2022-05-rubicon%3AH-08.md). Worse when the skipped hook also updates share/exchange-rate state, so mispricing compounds across later settlements.

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-04-ajna%3AH-2.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-06.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-05-rubicon%3AH-08.md