# Utilization check ordering and bypass

Ratio guards checked mid-action, on one side only, or against stale state, letting utilization pass caps

_Area: DeFi accounting and math bugs. Seen in 11 disclosed reports; latest 2025-08-13. Updated 2026-10-23._

## How it works
A utilization ratio (borrows / (cash + borrows - reserves), or borrows / total supply) is meant to bound risk. The assumption that breaks is that the ratio is validated on the correct, final state. When the guard runs inside a single action, before accumulators are populated, only on the borrow side, or after the state feeding it was already mutated, the ratio seen by the check differs from the ratio the protocol actually ends up in. The result is a ratio above the cap, above 100%, or a revert that bricks a path.

## Where it shows up
- Ratio computed as borrows/available instead of borrows/total, overstating utilization [E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-16.md)
- Guard only in borrow path; withdraw/redeem paths reduce the denominator without re-checking [E6](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-03.md)
- Guard placed before a same-transaction repay or settlement [E7](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-02.md)
- Multi-action batches where a temporary supply inflates the denominator at check time [E2](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-14.md)
- State (listing count, reserves) mutated before the checkpoint snapshot [E5](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-7.md)
- Division where denominator can fall below numerator, yielding util > 1e18 [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-2.md)
- Harvest/withdraw pulling full liquidity from a near-100% utilized market [E8](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-5.md)

## How to review
The invariant: for every path that changes borrows or supply, the utilization check must run on the post-operation state, and the ratio must be bounded by the same formula everywhere. Check each mutation site (borrow, withdraw, redeem, repay, batch, flash loan) for the guard; confirm accumulators are updated before the check [E3](https://bugbountylibrary.com/r/c4%3A2022-03-timeswap%3AH-01.md); confirm the denominator is total assets, not available liquidity [E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-16.md); confirm checkpoints snapshot pre-mutation state [E5](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-7.md); confirm the ratio cannot exceed 1e18 and downstream rate math cannot revert [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-2.md).

## Variants seen
- Util >100% via repay/redeem pushing rate past max, bricking accrual [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-2.md)
- Batch supply→borrow→withdraw bypassing per-action max_util [E2](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-14.md)
- Check inside loop before accumulators set, trivially passing [E3](https://bugbountylibrary.com/r/c4%3A2022-03-timeswap%3AH-01.md)
- Wrong denominator inflating interest [E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-16.md)
- Stale checkpoint understating fees [E5](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-7.md)
- Missing guard on withdraw side [E6](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-03.md)
- Guard on transient mid-transaction debt reverting valid flows [E7](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-02.md)
- Unbounded harvest withdrawal DoSing deposits [E8](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-5.md)

## Impact and severity
Bypassed caps let borrowers exceed limits, distort rates, and risk insolvency or lender loss [E2](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-14.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-03.md); inflated interest drains borrowers [E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-16.md); bricked accrual freezes the market [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-2.md); DoS blocks deposits [E8](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-5.md). Severity rises when the bypass is permissionless and repeatable.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-2.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-14.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-03-timeswap%3AH-01.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-16.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-7.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-03.md
- E7: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-02.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-5.md