# Shares vs assets unit mismatch

A share amount used where an asset amount is expected, or the reverse, in balances, ratios, or payouts

_Area: DeFi accounting and math bugs. Seen in 62 disclosed reports; latest 2026-09-05. Updated 2026-10-23._

## How it works
A protocol tracks value in two units: shares (a claim) and assets (the underlying). The exchange rate between them drifts away from 1:1. The bug is a code path that treats a share number as an asset number, or the reverse. The broken assumption is "a number is a number": the code assumes any balance it reads is already in the unit its formula expects. Once shares are worth more than one asset, every mix-up silently misprices balances, ratios, or payouts.

Invariant: every value crossing a boundary (strategy return, ratio input, pricing getter, liquidation math) is tagged with its unit, and every consumer converts shares to assets (or vice versa) exactly once.

## Where it shows up
- A function returns `deposit()`/`balanceOf()` output (shares) where callers expect assets [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-01.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AH-01.md).
- A ratio or NAV formula passes raw shares alongside token amounts while sibling formulas convert [E6](https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-03.md).
- A connector sums distinct share tokens (collateral, collateral-only, debt) and prices them as underlying [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-15.md).
- Stored fixed token amounts where the token rebases, so stored value drifts from balance [E3](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md).
- Pricing getters that read one raw token balance shared across several share classes [E1](https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md).
- Lending math reads `debtShares`/`supplyShares` and compares them to user-supplied asset amounts without the index [E5](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-2.md).
- A redeem path forwards vault shares to an underlying pool that treats them 1:1 with assets [E8](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-05.md).

## How to review
Grep every `balanceOf`/`deposit`/`totalAssets` return and confirm conversion at each call site. For each formula, trace each operand to its source and confirm shares are converted to assets (or vice versa) exactly once — check both directions. Double-conversion check: if a helper already returns assets, a caller that multiplies again by the exchange rate double-counts; grep for the conversion helper and confirm each result is consumed raw. Diff parallel formulas for token0/token1 or sibling consumers; a lone consumer skipping conversion is the tell [E6](https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-03.md). Read the target protocol's actual unit semantics rather than assuming an interface [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-15.md). For rebasing tokens, confirm accounting stores shares, not fixed amounts [E3](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md). For multi-class vaults, confirm per-class accounting, not a shared raw balance [E1](https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md). For lending forks, confirm every shares read is multiplied by its index before comparison [E5](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-2.md). For vault withdrawals, confirm the transferred asset amount equals the shares burned [E8](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-05.md). A mock that returns shares != assets exposes the mismatch; a mock returning shares == assets hides it [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-01.md).

## Variants seen
- Shares recorded as deposited assets in yield accounting [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-01.md).
- Strategy boundary returns ERC4626 shares instead of assets [E7](https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AH-01.md).
- Fixed token amounts stored for a rebasing token [E3](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md).
- Distinct share tokens summed and priced as underlying [E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-15.md).
- One ratio consumer skipping exchange-price conversion [E6](https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-03.md).
- Shared raw balance pricing multiple share classes [E1](https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md).
- Lending shares used as asset amounts in liquidation [E5](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-2.md).
- Vault shares forwarded to a 1:1 underlying pool on redeem [E8](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-05.md).

## Why fixes fail
Mocks returning shares equal to assets hide the mismatch entirely, so a fix can pass tests while still wrong [E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-01.md). A fix that adds a conversion at one call site can double-convert if the helper already returns assets, or leave sibling consumers unconverted [E6](https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-03.md).

## Impact and severity
Excess withdrawals, premature liquidation, insolvency gaps, permanently locked funds, and lost fee rights [E1](https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-01.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md)[E4](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-15.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-2.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AH-01.md)[E8](https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-05.md). Severity rises when the mismatch is reachable by any user and compounds across positions or share classes [E1](https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260905-reddio.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-07-benddao%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-05.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-15.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-2.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-03.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AH-01.md
- E8: https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AH-05.md