# Equality edge case full-balance transfer

Strict comparison falls through on equality or zero into a full-balance or skipped-update branch

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2024-02-13. Updated 2026-10-24._

## How it works
A guard is written as a strict comparison (`balance < tokenBalance`, `multi == 0`). The author reasons about the "normal" side and forgets the boundary. When the two values are equal, or a count is zero, the guard is false and control falls into a branch meant for a different case — one that moves the whole balance or skips an update. The broken assumption is that the else branch only runs when there is genuinely excess, or genuinely a multi-withdrawal. Equality and zero are reachable states, not impossible ones.

## Where it shows up
- Sweep/redundant/withdraw-excess functions with `if (x < y) ... else if (...) transfer(fullBalance)`.
- Accounting variables compared to `token.balanceOf(this)`; ask whether they can be equal.
- Flag checks like `multi == 0` selecting a path that bypasses a prior update step.
- Any `else`/`else if` reachable when a comparison is false by equality rather than by the intended condition.

## How to review
For each conditional branch, enumerate boundary inputs: equal values and zero. Confirm the branch taken at each boundary is the intended one. The invariant: a privileged sweep moves at most the computed excess, never the full balance; every code path consumes the updated data structure, not the raw input. Trace what `_updateTxData` (or equivalent) returns and verify every branch uses that result [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.7.md). For the sweep case, check whether the accounting variable can equal the actual token balance, making the excess guard false and the else-if transfer everything [E2](https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-05.md).

## Variants seen
- Single-item branch overwrites user-supplied data with keeper data, ignoring the conditionally updated structure [E1](https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.7.md).
- Equality between balance and token balance makes the excess guard false, so the else-if transfers everything [E2](https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-05.md).

## Impact and severity
E2 lets an owner drain all user deposits (critical). E1 leaves funds stuck or mis-swapped. Severity rises when the branch is privileged or when equality is attacker-controllable.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.7.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-05.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-10-mochi%3AM-09.md