# Counter incremented without matching decrement

Counters, heap order, or loop indexes mutated on one path but not restored on the reverse path

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-04-26. Updated 2026-11-01._

## How it works
A stored counter, index, or heap order is treated as authoritative by later code, but one mutation path changes the underlying state without updating that structure. The invariant "stored structure reflects current state" silently breaks. Later reads trust the stale value, so limits, skips, or early-break conditions act on wrong data.

## Where it shows up
- A persisted heap/priority structure rebuilt from storage assuming it is already sorted.
- Report/admin functions that bump a count (e.g. `exited`) without re-heapifying or re-storing.
- Period/rate limit counters incremented on request but not decremented on withdraw/reject/refund.
- Skip-index loops where the counter advances only in some branches.
- Early-break loops that stop on a zero/empty entry, trusting ordering.

## How to review
For every stored counter or ordered structure, enumerate all paths that change the underlying quantity and confirm each one updates the structure symmetrically. The property: after any mutation, the persisted structure must equal what a full rebuild would produce. For loops with skip logic, verify the index advances on every iteration, including skipped ones. For limit counters, trace every path that returns or refunds the limited asset and confirm a matching decrement.

## Variants seen
- Heap order not re-established after `reportOutOfOrderValidatorExits` bumps exited count; stale max points to zero-utilization operator and deallocation breaks early, blocking withdrawals [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-7.md).
- Misplaced `++i` inside an else branch makes `indicesToSkip` ignored, so a reverting strategy blocks slashing of the whole queued withdrawal [E2](https://bugbountylibrary.com/r/c4%3A2023-04-eigenlayer%3AH-02.md).
- Redeem limit incremented on request but never decremented on withdraw/reject, letting a whale exhaust the period limit and grief all other redemptions [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AM-2.md).

## Impact and severity
Led to blocked withdrawals [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-7.md), blocked slashing of malicious strategies [E2](https://bugbountylibrary.com/r/c4%3A2023-04-eigenlayer%3AH-02.md), and cheap griefing DoS of redemptions [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AM-2.md). Severity rises when the stale structure gates fund movement or safety actions, and when any single actor can drive the counter to its limit at low cost.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-7.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-04-eigenlayer%3AH-02.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AM-2.md