# Skipped-path accounting bypass in contracts

Early-return or unsupported-branch paths that skip gas, balance, or supply updates before erroring

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-04-10. Updated 2026-10-31._

## How it works
A function reaches a failure or unsupported case and returns early, before the code that applies accounting (charging gas, updating balances/supply, bumping counters). The assumption that "every path through this function settles the books" is false: the error path exits with the meter or ledger untouched. The caller still paid the cheap fixed cost, but the expensive work or the state change was never reconciled. Attackers repeat the cheap path to consume real resources or to leave accounting inconsistent.

## Where to show up
- Precompile/EVM glue where `UseGas(...GasConsumed())` or input-length charging sits *after* a fallible call (`MethodById`, `Unpack`, ABI decode) that can `return` first [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-04.md)[E3](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-08.md).
- Accounting helpers that silently ignore an uninitialized/`None` balance instead of reverting [E2](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-01.md).
- Branches for "unsupported chain" or "token not yet deployed" that proceed without updating the ledger [E2](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-01.md).
- Loops or repeated calls where each iteration can hit the early-return cheaply [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-04.md)[E3](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-08.md).

## How to review
For every function that mutates accounting, enumerate all return/error paths and confirm each one either applies the update or explicitly reverts. The invariant: **no exit path leaves the meter or ledger unapplied**. Specifically check ordering — is gas charged *before* any fallible parsing/decoding? Does an uninitialized balance cause a revert rather than a silent skip? Trace the unsupported-chain branch to confirm it cannot complete a transfer without a corresponding balance update.

## Variants seen
- Precompile returns error before charging local gas meter, so failed calls are free [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-04.md).
- Gas charged only after ABI lookup/unpack succeed; decode errors cost nothing [E3](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-08.md).
- `update_token_balance` ignores `None` balance, letting transfers to undeployed-token chains skip accounting [E2](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-01.md).

## Impact and severity
High: cheap failures burned node resources and could DoS a chain [E1](https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-04.md); a loop contract exceeded block time in ~2s [E3](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-08.md); bridge accounting mismatch could lock funds via front-run initialization [E2](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-01.md). Severity rises when the skipped path is cheap to trigger repeatedly and the skipped work is expensive or state-critical.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-11-nibiru%3AH-04.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-08.md