# Shared allowance mapping confusion

Allowance checked or decremented for the wrong address, or one mapping reused across paths with different consent semantics

_Area: Smart contract access control and control flow. Seen in 9 disclosed reports; latest 2025-03-19. Updated 2026-10-23._

## How it works
An allowance is a promise: "this spender may move up to N of my assets." The pattern breaks when the code consuming the allowance does not match the promise. Either the wrong address is treated as the spender (the receiver, the token contract, a re-encoded cross-chain sender), or one mapping serves paths with different consequences (borrow vs withdraw, plain approve vs a purpose-built consent), so consent given for one action authorizes another. The invariant that fails: the allowance checked and decremented must belong to the actual caller, for the exact action the owner consented to.

## Where it shows up
- A generic check that "first calldata argument equals msg.sender" applied across heterogeneous selectors (approve, setApprovalForAll), where the first arg is the spender/operator, not the owner [E7](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AH-12.md)[E8](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-02.md).
- Mint paths taking a caller-supplied `from` and pulling via safeTransferFrom without binding `from` to msg.sender [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-13.md).
- Cross-chain compose messages that encode the fund owner as the propagated sender instead of the caller, so the next hop skips allowance checks [E1](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AH-09.md).
- Redeem functions computing accrued yield from the owner's full balance but paying out regardless of the spender-controlled amount [E2](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-1.md).
- A custom consent mechanism (receiveAllowance) added, but mint/transfer paths still reading plain ERC20 allowance [E6](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.8.md).
- Batch transfer wrappers decrementing `allowances[from][to]` instead of `allowances[from][msg.sender]` [E5](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.1.2.md).

## How to review
For every path that reads or decrements an allowance, name the owner, the spender, and the action. Confirm the spender is msg.sender (or the intended delegate), not the receiver, token, or a re-encoded identity. For routers validating calldata, list every whitelisted selector and check its real ABI parameter order: is the first parameter the owner or the spender? For shared mappings, confirm each consumer enforces the same bookkeeping the grantor expected. For redeem paths, confirm the payout scales with the spender-authorized amount, not the owner's full balance.

## Variants seen
- Selector/ABI mismatch in a router's first-arg owner check [E7](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AH-12.md)[E8](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-02.md).
- Caller-supplied `from` in a pool mint path [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-13.md).
- Wrong identity re-encoded into a cross-chain compose message [E1](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AH-09.md).
- Full-balance yield payout ignoring the authorized amount [E2](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-1.md).
- Custom consent guard bypassed by the legacy allowance path [E6](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.8.md).
- Wrong index in an allowance decrement [E5](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.1.2.md).

## Impact and severity
Led to theft of NFTs and positions [E7](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AH-12.md)[E8](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-02.md), drained yield from a 1 wei allowance [E2](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-1.md), frontrun deposits [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-13.md), cross-chain token theft [E1](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AH-09.md), debt taken in a victim's name [E6](https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.8.md), and full-balance transfers from a small allowance [E5](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.1.2.md). Severity is high whenever the confused path moves assets or creates liabilities; the worst cases need only a tiny or pending approval.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AH-09.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-1.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-13.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-8.md
- E5: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.1.2.md
- E6: https://bugbountylibrary.com/r/cantina%3Asilo%3A3.2.8.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AH-12.md
- E8: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-02.md