# Stale accrual in share and rate math

Is every price, share rate, or reward metric computed after all pending value is settled into state?

_Area: DeFi accounting and math bugs. Seen in 76 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
A share price, exchange rate, or reward metric is derived from stored balances plus a timestamp or cached rate. The broken assumption: the stored state already reflects everything that happened up to now. When accrual is lazy (computed on read) or skipped on some path, the derived value is computed against stale inputs. Two invariants must hold: (1) accrue-before-read — any value used to price shares or settle claims is computed after all pending interest, fees, losses, and injections are flushed; (2) checkpoint-before-change — every path that mutates balances or config flushes pending accrual before the new value takes effect.

## Where it shows up
- `totalAssets()`/share price reading pool balances without syncing the interest index first [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-4.md).
- A loss reported from one asset balance while offsetting collateral gains are still unrealized [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-yearn-ybold%3AH-2.md).
- Preview paths that filter earnings by a time window while settlement applies them unconditionally [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-15.md).
- Deposit pricing shares before an accrual call that redeem performs first — asymmetric ordering [E5](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-05.md).
- Governance setters that write a rate or factor without checkpointing elapsed time or recomputing rates [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-26.md).
- "Same block, skip refresh" guards around state that can change intra-block (defaults, liquidations) [E7](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-11.md).
- Withdrawal queues that snapshot payout at request time, before a later slashing/rate drop [E4](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-7.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-02.md).

## How to review
For every function that reads a price, rate, or share value, trace whether all pending accrual has been flushed into state first — name the call site (`update_state()`, `forceUpdateReserve`, `updateFunding`, `checkpoint`) and confirm it runs on that path. Check setters: do they checkpoint before writing the new parameter? Check caches: can the cached state change within the same block? Check deposit vs redeem: is the accrual call ordered the same on both? Check queues: is payout recomputed at settlement against the current rate? A false positive looks like a setter that only affects future accrual and is read after an explicit sync on every path — verify the read path actually calls it. A queue that intentionally locks a fixed redemption rate is also safe if the design accepts that risk.

## Variants seen
- Loss reported before offsetting gain realized, cheap deposits [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-yearn-ybold%3AH-2.md).
- Deposit/withdraw skipping index sync, retroactively repricing elapsed time [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-4.md).
- Preview window filter vs unconditional settlement mismatch [E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-15.md).
- Withdrawal rate locked at request time, pre-slash [E4](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-7.md).
- Deposit prices before accrual, redeem after — same-block profit [E5](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-05.md).
- Config setter without checkpoint, stale split accrues [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-26.md).
- Same-block cache guard missing an intra-block rate drop [E7](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-11.md).
- Queue payout snapshotted before slashing, first-come drain [E8](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-02.md).

## Impact and severity
Overpaid rewards [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-yearn-ybold%3AH-2.md), diluted or sandwiched redeemers [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-4.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-15.md)[E5](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-05.md), losses shifted to later stakers [E4](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-7.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-02.md), under-collected reserves [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-26.md), vault insolvency [E7](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-11.md). Severity rises when the mispricing is repeatable or attacker-triggerable within one transaction, and when the stale read is on a settlement path rather than a preview.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-05-yearn-ybold%3AH-2.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AH-4.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-15.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-7.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-05.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-26.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-11.md
- E8: https://bugbountylibrary.com/r/c4%3A2025-04-kinetiq%3AH-02.md