# Debt counters not decremented on close

Close, repay, write-off and claim paths that update one debt figure but leave another stale or unaccrued

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-07-17. Updated 2026-10-24._

## How it works
A protocol records "how much is owed" in several places: an aggregate total, a per-position principal, a bad-debt bucket, a pending-reward base, and cached market totals. The assumption that breaks is that all copies move together, or that a cached figure already includes everything it should. A close, repay, write-off or claim path updates one copy and leaves another stale, or reads a total before interest is folded in. Ratios built on that figure (collateral vs debt, liquidity vs debt, health ordering) then describe a position that no longer matches reality.

## Where it shows up
- Repay/withdraw hooks that read a cached market total (e.g. `totalBorrowAssets`) without accruing interest first [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1.md)
- Bad-debt branches that add to a `bad_debt` counter but never subtract from `total_debt_amount` [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md)
- Reward-claim or redistribution paths that fold pending debt into the interest-bearing principal [E3](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.11.md)
- Any write-off that touches only one aggregate, or an amount subtracted twice [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md)
- Sorted-list or health-factor code that assumes identical positions stay identical

## How to review
For each state-changing path, list every counter that encodes debt or collateral and confirm the path updates all of them in the same branch. Invariant 1: after any close, repay or write-off, the sum of per-position debt equals the aggregate debt, and available liquidity reflects only genuinely outstanding debt [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md). Invariant 2: for ratio math, the debt figure is fully accrued (interest included) before it is compared to collateral; a cached total must be accrued or refreshed first [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1.md). Invariant 3: no user action changes the interest-bearing principal of one position relative to an identical one, so ordering keys stay consistent [E3](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.11.md).

## Variants seen
- Derived debt not fully accrued: cached market total understates debt, inflating withdrawable collateral on partial repay [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1.md)
- Bad debt added to `bad_debt` without reducing `total_debt_amount`, so repaid debt still blocks withdrawals [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md)
- Claiming redistribution rewards grows one Trove's debt faster than an identical Trove, breaking sort order [E3](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.11.md)

## Why fixes fail
In E2 the drift persisted even after `repay_bad_debt`: the counter was never decremented, so repayment could not restore liquidity. Fixing only the repay path without correcting the original write-off leaves the drift in place. This is single-evidence; other variants may not share it.

## Impact and severity
Outcomes ranged from inflated collateral withdrawal pushing users near LLTV and into liquidation risk [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1.md), to LP funds permanently blocked despite repaid bad debt [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md), to broken protocol-wide ordering invariants [E3](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.11.md). Severity rises when the drifted counter gates liquidity or liquidation, since the error compounds with every later operation.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-1.md
- E3: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.11.md