# Unaccounted collateral after settlement

Settlement or claim paths that skip state cleanup, leaving collateral, earnings, or balances live and reusable

_Area: DeFi accounting and math bugs. Seen in 11 disclosed reports; latest 2026-06-22. Updated 2026-10-23._

## How it works
A settlement or claim path is supposed to consume a position: burn the lien, release the NFT, convert earnings, register the asset, or return leftover funds. The bug is that one path does only part of that work. The position's bookkeeping (a collateral token, an unassigned-earnings bucket, an asset list entry, a struct field, a TVL figure) stays alive or stays zero, so the contract's view of what a user owns no longer matches reality. The broken assumption is that "settled" and "claimed" leave the same state, or that a returned struct is fully populated, or that crediting a balance also registers the asset.

## Where it shows up
- Parallel settle/claim/repay/liquidate/buyout paths that touch the same position.
- A liquidation path that deliberately skips fee or earnings accounting.
- A variable used both as a constraint and as a derived value across branches.
- Library functions returning structs whose fields the caller reads.
- Enumerable asset lists tracked separately from per-asset balance mappings.
- Callees that return unspent tokens; TVL/share-price functions that count only some balances.
- Compound-style forks where collateral counts only if the market is entered.

## How to review
For each path that moves value or ends a position, list the state it must update and diff it against sibling paths. The invariant: after any terminal action, no collateral, lien, earnings, or asset-list entry remains that lets the user act again or claim value they no longer own; and every field a caller reads is assigned by the callee. Check that supply paths call enterMarkets, that seizure/reward paths register the asset, and that TVL includes all idle balances.

## Variants seen
- Claim skips auction settlement, collateral token survives and is re-borrowed [E1](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-05.md).
- Liquidation skips unassigned earnings; next minimal depositor captures them [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-2.md).
- Constraint branch never recomputes the derived amount, underpaying bond [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-4.md).
- Returned struct field left uninitialized, freezing all collateral [E4](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-8.md).
- Supply never enters market, so collateral is invisible to liquidity checks [E5](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-2.md).
- Seized asset credited but not registered, redeem reverts [E6](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-9.md).
- Buyout skips lender pool hook, shares mispriced [E7](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-06.md).
- Unspent tokens neither returned nor counted in TVL [E8](https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-02.md).

## Impact and severity
Vault drain [E1](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-05.md), theft of earnings [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-2.md), permanent freeze of collateral [E4](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-8.md), trapped rewards [E6](https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-9.md), mispriced shares [E7](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-06.md), depositor losses [E8](https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-02.md). Severity rises when the skipped state is reusable by an attacker or when value is permanently locked.

## Why fixes fail
Fixing one path (e.g. repay) without the sibling (buyout, claim) leaves the same gap [E1](https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-05.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-06.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-05.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-4.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-8.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-2.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2025-05-lend-audit-contest%3AM-9.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-06.md
- E8: https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-02.md