# Alternate path bypasses access check

Second path to protected state skips the guard the main entrypoint enforces

_Area: Smart contract access control and control flow. Seen in 7 disclosed reports; latest 2026-10-15. Updated 2026-10-23._

## How it works
A contract enforces an authorization or state check on its main entrypoint, then creates or mutates the same protected state through a second path that never runs that check. The invariant ("only the lender may liquidate", "only active receivers gain votes", "only the project's allowed resources may be created") is assumed to hold globally but is actually enforced at one call site. Any other function, hook, or lifecycle stage that reaches the same internal write becomes an unguarded door. The same root cause also appears inverted (a guard so strict the only path is blocked) and shifted (the guard checks the wrong actor).

## Where it shows up
- A boolean flag gating one branch, where the other branch has no separate `require`.
- Helper functions that instantiate accounts, positions, or objects without the validation the primary entrypoint runs.
- Multiple public functions writing the same storage; only some call the guard function.
- "Shortcut" or "unchanged" early-return paths that skip re-validation.
- Lifecycle/teardown code (delete hooks, finalizers, cascading deletion) audited separately from the main reconcile path.
- Overridden ERC4626-style hooks where caller, receiver, and owner are distinct actors.
- Guards on `msg.sender == trustedContract` where the trusted contract never calls you.

## How to review
List every function, hook, and lifecycle stage that can create or change the protected state. For each, trace to the internal function performing the actual write and confirm the check runs on that path. The property: for every state transition the guard is enforced at or below the shared internal write, so no caller reaches the write without it. Put the guard once at the shared internal function rather than duplicating it per entrypoint. Diff guard calls between entrypoints; a missing call is the bug. For multi-actor hooks, confirm every actor whose state changes is checked. For `msg.sender == trusted` gates, confirm the trusted contract actually calls you.

## Variants seen
- Flag-gated privileged branch with no check in the negative case: anyone liquidates and seizes collateral [E2](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-06.md).
- Secondary flow (vote-weight re-add) skips the active-receiver check enforced only in `_storeAccountVotes` [E5](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.18.md).
- Delete-hook creation path never applies the project allow/deny checks the sync path enforces [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fmxq-cgp8-87wp.md).
- Overridden `_withdraw` checks caller and receiver but not the owner, so an approved spender launders a restricted owner [E6](https://bugbountylibrary.com/r/c4%3A2023-10-ethena%3AM-01.md).
- Parallel ownership state (registry vs wrapper): unwrap/re-wrap mutates the authoritative owner of a fused child [E1](https://bugbountylibrary.com/r/c4%3A2022-11-ens%3AH-01.md).
- Over-restrictive guard blocks the only path, so the feature never runs (inverted) [E7](https://bugbountylibrary.com/r/c4%3A2023-09-centrifuge%3AM-01.md).

## Impact and severity
Led to seizure of all collateral without payment [E2](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-06.md), votes extended for deactivated receivers [E5](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.18.md), cluster-scoped objects created with controller credentials [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fmxq-cgp8-87wp.md), and restricted stakers redeeming via a spender [E6](https://bugbountylibrary.com/r/c4%3A2023-10-ethena%3AM-01.md). Severity is high when the bypassed check protects funds or governance weight; worse when the alternate path is permissionless and the state change is irreversible.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-11-ens%3AH-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-06.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-fmxq-cgp8-87wp.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AM-22.md
- E5: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.18.md
- E6: https://bugbountylibrary.com/r/c4%3A2023-10-ethena%3AM-01.md
- E7: https://bugbountylibrary.com/r/c4%3A2023-09-centrifuge%3AM-01.md