# Stale outer state overwrites inner mutation

Nested or aliased writes where a cached outer copy is committed over a fresher inner update

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2026-05-06. Updated 2026-10-29._

## How it works
Two layers each hold a copy of the same state. An inner layer mutates its copy; an outer layer still holds the pre-mutation copy and commits it last, so the inner change is silently lost. The broken assumption is that the outer copy is authoritative or that the inner write is visible to it. When the layers are separate journals, separate deserialized accounts, or separate in-memory structs, the inner write never reaches the outer copy, and the final commit reverts it.

## Where it shows up
- Precompiles or handlers that mutate state via a nested call/`ApplyMessage`/fresh StateDB while the outer context keeps its own dirty slots [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6447-269v-g68m.md)
- Instructions taking multiple accounts of the same type where callers can pass the same pubkey twice [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AM-3.md)
- Migration or upgrade paths writing new mappings that default to zero for legacy entries [E3](https://bugbountylibrary.com/r/c4%3A2023-07-lens%3AM-02.md)
- Ownership/identity zeroed before dependent bookkeeping reads it back [E4](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-14.md)
- Any commit/flush/serialize step that writes a cached copy unconditionally

## How to review
Identify every state slot written in more than one layer. The invariant: for each slot, the last writer must be the layer holding the freshest value, and inner mutations must be journaled or synced into the outer copy before commit. Check:
- Does the outer commit write slots unconditionally, or only when it has a newer value?
- Can two account parameters alias to the same pubkey? If so, are their writes merged or sequential-overwrite? [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AM-3.md)
- Does a migration path cross-check the same guard as the normal path? [E3](https://bugbountylibrary.com/r/c4%3A2023-07-lens%3AM-02.md)
- Is ownership/identity mutated before or after dependent reads? [E4](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-14.md)

## Variants seen
- Nested StateDB burn invisible to outer journal, overwritten at commit [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6447-269v-g68m.md)
- Aliased Anchor accounts: last serialized copy clobbers earlier reserve update [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AM-3.md)
- Missing already-following guard lets migration double-count [E3](https://bugbountylibrary.com/r/c4%3A2023-07-lens%3AM-02.md)
- Ownership zeroed before delegation cleanup wipes checkpoints [E4](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-14.md)

## Impact and severity
Ranged from corrupted accounting (double-counted followers, wiped checkpoints) [E3](https://bugbountylibrary.com/r/c4%3A2023-07-lens%3AM-02.md)[E4](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-14.md) to full bridge drain [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6447-269v-g68m.md). Severity rises when the overwritten slot gates value transfer or when the overwrite is repeatable, letting an attacker drain repeatedly [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6447-269v-g68m.md). Aliasing and ordering bugs are easy to miss because each layer looks correct in isolation.

## Why fixes fail
Fixes that patch one path leave the other: adding a guard to `follow()` without the symmetric check in `tryMigrate()` still allows double-count [E3](https://bugbountylibrary.com/r/c4%3A2023-07-lens%3AM-02.md); fixing ordering in one caller leaves the library's in-place loop bug [E4](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-14.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-6447-269v-g68m.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AM-3.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-07-lens%3AM-02.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-14.md