# Stranded funds with no exit path

Inflows whose matching outflow is missing, disabled, capped, or access-restricted, leaving tokens unreachable

_Area: DeFi accounting and math bugs. Seen in 10 disclosed reports; latest 2026-01-05. Updated 2026-10-23._

## How it works
A contract takes an asset in through one path but has no working path to send that same asset back out. The assumption that breaks is "every inflow has a matching outflow." When a deposit, sweep, pause, kill, or migration moves value into a contract or accounting bucket, and the only exit targets a different asset, is deactivated, is capped by a counter, or is gated by access control, the funds stay put. The bookkeeping can still look balanced while the real tokens are unreachable.

## Where it shows up
- A `_supply`/deposit into a lending pool with no matching withdraw of that same asset [E3](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-01.md)
- Leftover-balance "sweep back to pool" logic after swaps or debt repayment [E3](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-01.md)
- Pause/kill functions that zero an accounting entry (`claimable[x] = 0`) without transferring tokens out [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-velocimeter%3AH-4.md)
- Redemption deactivated, or withdraw capped by a deposited counter [E5](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AH-4.md)
- Empty `else` branches or TODOs in reward accrual when a count is zero (no knots, no shares) [E7](https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-21.md)
- State updated in functions callable during emergency/pause whose distribution path is disabled [E6](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-04.md)
- Migration/upgrade that replaces a strategy pointer after a `withdrawAll` that can partially fail [E8](https://bugbountylibrary.com/r/c4%3A2022-01-sherlock%3AM-03.md)
- Exit exists but is restricted to a role or address that cannot or will not call it

## How to review
Enumerate every inflow path for each asset and confirm a reachable outflow path for that same asset, including who may call it. For each pause, kill, merge, or migration, check that tokens are transferred out or remain claimable, not just that a counter is zeroed. For counter-capped withdraws, compare the counter against the actual token balance held; if balance exceeds the counter, the excess is stranded. For migrations, require `withdrawAll` to fully succeed before the old module is orphaned, or that partial withdrawals stay recoverable. The invariant: for every asset the contract can receive, some caller can eventually retrieve it.

## Variants seen
- Deposit into pool, no withdraw of that asset [E3](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-01.md)
- Kill/pause zeroes claimable without transfer [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-velocimeter%3AH-4.md)
- Deactivated redemption plus counter-capped withdraw [E5](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AH-4.md)
- Zero-count state leaves incoming ETH unaccounted, later misallocated or locked [E7](https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-21.md)
- Emergency mode credits earnings whose distributor is disabled [E6](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-04.md)
- Migration orphans a strategy after partial withdraw [E8](https://bugbountylibrary.com/r/c4%3A2022-01-sherlock%3AM-03.md)

## Impact and severity
Permanent loss of user or protocol funds; in E5 the stranded collateral makes the stablecoin undercollateralized. Severity is high because funds are unrecoverable without an upgrade. It worsens when the stranded asset backs outstanding liabilities [E5](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AH-4.md) or when the exit is an emergency path users rely on [E6](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-04.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-14.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-12-amun%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-01.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-06-velocimeter%3AH-4.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AH-4.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-04.md
- E7: https://bugbountylibrary.com/r/c4%3A2022-11-stakehouse%3AM-21.md
- E8: https://bugbountylibrary.com/r/c4%3A2022-01-sherlock%3AM-03.md