# Held-back tokens never refunded on exit

Exit paths that retain shares, rewards, or surplus instead of returning them to the user

_Area: DeFi accounting and math bugs. Seen in 17 disclosed reports; latest 2025-02-17. Updated 2026-10-22._

## How it works
An exit or settlement path computes a payout that is smaller than what the user actually gave up, or leaves a remainder on the contract. The assumption that breaks is "what is removed equals what is returned." When fee deduction, rounding, or a skipped accounting update is applied to the removal side but not tracked on the return side, the difference stays in the contract with no owner and no way out.

## Where it shows up
- Share-accounting hooks called with a fee-netted amount instead of the gross bonded amount [E1](https://bugbountylibrary.com/r/c4%3A2024-03-acala%3AM-03.md)
- Upfront funding for a maximum amount, where the payout path can never consume it all (rounding, zero-participant periods) and no sweep exists [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-6.md)
- Lazy-accrual state (redistribution, pending debt) that cannot be flushed once the system is frozen [E3](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-02.md)
- Tokens arriving via a path the contract does not track (validator auto-unbonding) so withdrawal logic never sees them [E4](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-5.md)
- Whitelisted routers that block the only call that could claim surplus or refunds [E5](https://bugbountylibrary.com/r/c4%3A2023-10-badger%3AH-01.md)
- Yield-bearing tokens held on behalf of users where the reward-claim call is never made [E6](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md)
- Division-by-zero guards that skip an accounting update, leaving the skipped value untracked [E7](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.23.md)
- Swap-and-repay functions that leave surplus output on contract balance [E8](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-33.md)

## How to review
For every path that removes value from a user, trace the exact quantity removed and the exact quantity returned, and confirm they match or that the difference is explicitly credited somewhere reachable. The invariant: any token or share that leaves a user's position must either be paid to that user or recorded in a balance they can later withdraw. Check that fee math and share math use separate values [E1](https://bugbountylibrary.com/r/c4%3A2024-03-acala%3AM-03.md), that every inflow path has a matching outflow path [E4](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-5.md), and that frozen/shutdown states still allow pending value to be released [E3](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-02.md).

## Variants seen
- Fee-netted amount passed to share removal [E1](https://bugbountylibrary.com/r/c4%3A2024-03-acala%3AM-03.md)
- Unconsumable upfront funding with no sweep [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-6.md)
- Lazy accrual unreachable after shutdown [E3](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-02.md)
- Untracked inflow bypassing the withdrawal queue [E4](https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-5.md)
- Blocked claim path for surplus collateral [E5](https://bugbountylibrary.com/r/c4%3A2023-10-badger%3AH-01.md)
- Unclaimed external rewards [E6](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md)
- Skipped update under a guard [E7](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.23.md)
- Surplus left on contract after swap-repay [E8](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-33.md)

## Impact and severity
Funds become permanently stuck or skimmable by any caller [E8](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-33.md), and residual shares keep earning rewards they should not [E1](https://bugbountylibrary.com/r/c4%3A2024-03-acala%3AM-03.md). Severity rises when the stranded value is user principal rather than yield, and when no sweep or admin recovery exists [E2](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-6.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-03-acala%3AM-03.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-6.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-02.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-5.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-10-badger%3AH-01.md
- E6: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-06.md
- E7: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.23.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-33.md