# Unrefunded Excess Native Value

Payable functions accepting msg.value above the required amount without refunding or accounting for the surplus

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-05-03. Updated 2026-10-23._

## How it works
A payable function needs a specific amount of native value (a fee, a swap input, a repayment). It checks that `msg.value` is *at least* that amount, then uses only the required portion. The surplus stays in the contract balance but is never recorded in internal accounting, and withdrawal logic only pays out accounted amounts. The excess becomes permanently stranded. The broken assumption is that callers send exactly the right amount; in practice accrued-interest flows and fee calculations force overpayment, so any non-refunding receive path silently locks funds.

## Where it shows up
- Payable entry points that check `msg.value < amount` and revert, but have no branch for `msg.value > amount`.
- Internal calls that forward `msg.value` where an explicit `maxIn`/`amount` parameter was actually pulled from the caller.
- Cross-chain or zap wrappers with multiple `msg.value` branches where error paths refund but success paths do not.
- Contracts whose stated invariant is "native balance is always zero" but no code enforces it.

## How to review
For every payable function, trace the full `msg.value`: how much is consumed, how much is forwarded, and whether the remainder is refunded to the caller or credited in internal accounting. The invariant to confirm: after any call, `address(this).balance` equals the sum of accounted native obligations, and any surplus is returned. Diff each `msg.value` branch (success vs. error) to confirm both refund. Check internal call arguments against the token actually pulled, not `msg.value`.

## Variants seen
- Overpaid ETH accepted and locked across five entry points, never recorded in accounting [E1](https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AM-03.md).
- Zap passes `msg.value` (0) instead of the pulled `maxWethIn`, stranding user ETH [E2](https://bugbountylibrary.com/r/c4%3A2021-12-nftx%3AH-01.md).
- Router forwards only the fee portion of `msg.value` on success, never refunding the rest [E3](https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AH-01.md).

## Impact and severity
Permanent loss of user funds in every case; severity high where amounts are unbounded or forced by interest/fee math. Worse when the surplus is invisible to accounting, so no recovery path exists and the protocol's own balance invariant is silently violated [E1](https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AM-03.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AH-01.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AM-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-12-nftx%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AH-01.md