# Payout without backing or accounting

Outgoing transfers or payouts not matched by a debit, incoming payment, or backing reduction

_Area: DeFi accounting and math bugs. Seen in 9 disclosed reports; latest 2025-05-16. Updated 2026-10-23._

## How it works
A contract moves value out (a payout, refund, fee, or margin transfer) but the bookkeeping that should offset it is missing or computed from the wrong quantity. The tracked balance, collateral backing, or per-recipient accounting then no longer matches reality. The broken assumption is that every outflow is paired with a matching debit or incoming payment; when it is not, the contract pays from funds it does not own or mints claims with nothing behind them.

## Where it shows up
- Fee or payout transfers paid from the contract's pooled balance rather than from the payer [E2](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-05.md).
- Payout computed from a gross amount while a fee is skimmed from the same token, leaving the fee unbacked [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AH-1.md).
- A declared total validated against allowance/balance but not against the sum of individual amounts [E5](https://bugbountylibrary.com/r/dhl%3A20250516-bitallx.md).
- Mutable pool totals combined with permanent per-recipient paid flags [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9.md).
- Per-trade transfers computed from absolute position size instead of the delta [E4](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-13.md).

## How to review
For each outgoing transfer, identify the matching debit or incoming transfer and confirm it exists and is the same asset and amount. Check that any payout derived from a burned/redeemed amount subtracts the fee before computing collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AH-1.md). In multi-recipient functions, assert sum(amount[]) equals the declared total and reject zero totals with non-zero amounts [E5](https://bugbountylibrary.com/r/dhl%3A20250516-bitallx.md). For pooled balances, confirm each fee is funded by the payer, not the pool [E2](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-05.md). For mutable totals, confirm late deposits remain claimable or are sweepable [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9.md). For per-trade transfers, confirm the amount is the net delta [E4](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-13.md).

## Variants seen
- Unbacked fee yUSD sent to insurance fund while full collateral paid to user [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AH-1.md).
- triggerFee paid from contract balance, draining other auctions [E2](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-05.md).
- Late pool funding locked by permanent paidOut flags [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9.md).
- Absolute-size margin transfers drained by round-tripping [E4](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-13.md).
- Zero totalSendAmount with arbitrary payout amounts [E5](https://bugbountylibrary.com/r/dhl%3A20250516-bitallx.md).

## Impact and severity
Led to insolvency and depeg [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AH-1.md), blocked settlements of parallel auctions [E2](https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-05.md), locked funds [E3](https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9.md), blocked user actions [E4](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-13.md), and direct USDT drain [E5](https://bugbountylibrary.com/r/dhl%3A20250516-bitallx.md). Severity rises when funds are pooled across users or when the mismatch compounds over repeated calls.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AH-1.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-04-gondi%3AH-05.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-09-Gitcoin%3AM-9.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-13.md
- E5: https://bugbountylibrary.com/r/dhl%3A20250516-bitallx.md