# Balance inflow as solvency proof

Checks that accept any balance delta or same-tx deposit instead of the actual transfer

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2023-04-11. Updated 2026-10-25._

## How it works
A health, utilization or solvency check reads a live token balance (or its delta) and treats it as proof that value was really paid or supplied. The assumption that breaks: a balance increase means the actor transferred funds. In practice any inflow counts — a same-transaction deposit, or a purchase of the victim's own assets — so the check passes while the real obligation is unmet or the pool is drained.

## Where it shows up
- Utilization or ratio checks in `borrow()` that read `balanceOf` at call time [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-2.md)
- Liquidation checks that measure the liquidatee's token balance delta after a callback, rather than the liquidator's transfer [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-8.md)
- Any invariant enforced by "balance went up by X" rather than "caller paid X"
- Flash-loan callbacks that run between the check and the settlement

## How to review
The invariant: the check must verify the *caller's* funds moved, not that some balance grew. Concretely:
- Does the utilization/health check use a balance the caller can change within the same transaction (deposit, self-transfer, buying assets)? If yes, snapshot the balance before the action and compare against that snapshot, or exclude caller-controlled deltas [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-2.md).
- In liquidation, is the payment proven by a transfer from the liquidator (allowance/transferFrom, or a recorded debit), or merely by the liquidatee's balance delta? Only the former is safe [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-8.md).
- Trace every path that can raise the measured balance between check and use.

## Variants seen
- Same-tx deposit inflates the loan-token balance to pass a utilization check, then the deposit is withdrawn, leaving utilization at 100% [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-2.md)
- Liquidator buys the liquidatee's USDC-denominated assets, so the liquidatee's USDC balance rises without the liquidator paying the debt [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-8.md)
- Token transfer logic reported as mishandling self-transfers or flash-loan balance updates, enabling inflation; root cause unconfirmed [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md)

## Impact and severity
Full liquidity drain of a lending pool [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-2.md) and liquidation debt avoided [E2](https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-8.md). Severity is high: the flaw is reachable in one transaction, needs no capital thanks to flash loans, and directly moves funds. Worse when the check sits inside a callback or same-tx window the attacker controls.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-2.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-8.md
- E3: https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md