# Split quotes against stale supply

Multiple quotes or swaps in one tx priced against the same un-updated supply, over-minting or bypassing caps

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-03-06. Updated 2026-10-29._

## How it works
A price or quote is computed from a supply/state variable, but that variable is only updated once at the end of the transaction. When the same transaction performs several quotes or swaps, each one reads the same stale supply, so the curve is applied repeatedly to slices of the payment instead of once to the total. For convex or non-path-independent pricing, the sum of split quotes exceeds the single-quote result, and the contract mints or pays out more than intended.

## Where it shows up
- A quote function called more than once in one function body, all reading the same supply/emitted state before it is written.
- Bonding-curve, VRGDA or price-impact math where N small trades do not equal one large trade.
- Swap limits (max notional, gamma, caps) checked per call rather than against the transaction total.
- Public mint/swap functions taking ETH with weak price validation [E3](https://bugbountylibrary.com/r/dhl%3A20240223-zoomer.md).
- Loops or batch paths that quote per recipient against shared state.

## How to review
Check the invariant: for any payment P split into P1+P2, the tokens/quotes returned must equal quoting P once, or the supply must be updated between quotes. Trace every read of the supply variable and confirm it is refreshed after each quote/mint. Confirm caps and limits are enforced on the aggregate, not per call. For AMMs, verify the price-impact formula is path-independent, or that a single tx cannot chain swaps against unchanged reserves.

## Variants seen
- AMM split-sell: many small sellBase calls in one tx beat one large swap and bypass maxGamma/maxNotionalSwap [E1](https://bugbountylibrary.com/r/sherlock%3A2024-03-woofi-swap%3AM-2.md).
- VRGDA double-quote: creator and buyer amounts each quoted against the same emittedTokenWad, over-minting governance tokens [E2](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-10.md).
- Public mint with flawed validation: small ETH payment mints disproportionate tokens, draining pools [E3](https://bugbountylibrary.com/r/dhl%3A20240223-zoomer.md).

## Impact and severity
Over-minting of tokens or excess quote payout, bypassing swap caps, and pool drainage (E3: 30M tokens for 0.02 ETH, ~14 ETH drained). Severity rises when the excess is immediately redeemable or when caps meant to bound exposure are silently bypassed.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-03-woofi-swap%3AM-2.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AM-10.md
- E3: https://bugbountylibrary.com/r/dhl%3A20240223-zoomer.md