# Stale state delta reused in accounting

Check whether the balance, reserve or quote used in math is refreshed and decremented after each state change

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-09-18. Updated 2026-10-29._

## How it works
A value that should track live state (AMM reserves, accrued debt, pool balance) is computed once or read from a stored snapshot, then reused. The code assumes the value reflects reality at call time, but nothing writes back the delta or re-accrues interest. Repeated calls therefore act on the same stale number, so each call extracts value the contract thinks it still has.

## Where it shows up
- Sibling code paths that differ: one branch writes a delta field, the other omits it (leverage>0 vs leverage==0) [E1](https://bugbountylibrary.com/r/dhl%3A20260918-likwid.md)
- Health, liquidation or warning math reading a stored balance instead of an interest-previewed one [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-3.md)
- Payout or share formulas using an initial pool balance that is never decremented after withdrawal [E3](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-08.md)
- A numerator that stays constant while the denominator (totalSupply, reserves) shrinks
- Any quote function whose inputs are not updated by the action that consumes the quote

## How to review
For every value feeding share, quote or health math, trace where it is written. The invariant: after any action that changes reserves, debt or pool balance, the value used by the next call must reflect that change. Diff sibling paths field by field and confirm each delta assignment exists. Confirm health checks use current accrued balances, not last-accrual snapshots. Confirm payout numerators are decremented alongside denominators.

## Variants seen
- Missing reserve write-back in a borrow path, freezing the AMM quote [E1](https://bugbountylibrary.com/r/dhl%3A20260918-likwid.md)
- Stored borrow balance used in health checks, allowing bad debt in one transaction [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-3.md)
- Initial pool balance reused across successive cash-outs [E3](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-08.md)

## Impact and severity
Led to full vault drain (74.31 BNB) [E1](https://bugbountylibrary.com/r/dhl%3A20260918-likwid.md), intentional bad debt in a single transaction [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-3.md), and Ether drained from a buyout contract [E3](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-08.md). Severity is high: the flaw is repeatable within one transaction and directly moves funds. Worse when the stale value gates a solvency check, since it lets unsafe positions pass.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260918-likwid.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-3.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-08.md