# Missing fee or allowlist check on one path

Does every path enforce the same fee, allowlist, and registration checks as the main path?

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2026-05-18. Updated 2026-10-23._

## How it works
A contract enforces a safety check on its main path (fees must be zero, a caller must be allowlisted, a market must be registered) but a second path reaches the same sensitive operation without that check. The assumption that breaks is "all entry points share one validation routine." When one path skips a constraint, an attacker or a lifecycle change routes value or authority through the unchecked path.

## Where it shows up
- Order validation that checks tokens, price, recipient, and slippage but never constrains fee fields [E2](https://bugbountylibrary.com/r/c4%3A2022-01-notional%3AH-03.md).
- Bridge/guard verifiers that decode a value or refund address but discard it, validating only target and selector [E1](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-01.md).
- Overridden transfer hooks with a hardcoded allowlist of protocol contracts [E3](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-4.md).
- Registry membership checks (`isRegistered`) used downstream of a registry that also supports removal [E4](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md).
- Any struct field the downstream fill math consumes but the validator ignores.

## How to review
Enumerate every field and every caller the downstream operation actually consumes, then confirm the validator constrains each one. The invariant: for a given sensitive action, all paths enforce an identical set of constraints. For orders, require fee fields to be zero (or bounded) [E2](https://bugbountylibrary.com/r/c4%3A2022-01-notional%3AH-03.md). For bridged calls, constrain value and refund recipients, not just target/selector [E1](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-01.md). For allowlists, list every contract that must custody the token [E3](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-4.md). For registries, decide whether removed-but-live entities must still pass membership checks [E4](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md).

## Variants seen
- Fee fields unconstrained in signed-order validation, letting a manager route maker proceeds to fees [E2](https://bugbountylibrary.com/r/c4%3A2022-01-notional%3AH-03.md).
- Bridge verifier ignores value and refund addresses, enabling ETH diversion [E1](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-01.md).
- Transfer-hook allowlist omits a legitimate protocol contract, breaking a path [E3](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-4.md).
- Lifecycle asymmetry: removed markets still operate but fail registration checks, defeating sanctions [E4](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md).

## Impact and severity
Consequences ranged from fund loss (treasury tokens burned [E2](https://bugbountylibrary.com/r/c4%3A2022-01-notional%3AH-03.md), timelock ETH exfiltration [E1](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-01.md)) to broken functionality [E3](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-4.md) and sanctions evasion [E4](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md). Severity rises when the unchecked path moves value or bypasses compliance, and when the gap is invisible because the main path looks correct.

## Why fixes fail
Adding a check to one path without auditing sibling paths leaves the gap open; the evidence repeatedly shows the constraint present on the main path but absent on a secondary one [E1](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-01.md)[E2](https://bugbountylibrary.com/r/c4%3A2022-01-notional%3AH-03.md)[E4](https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-01-notional%3AH-03.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-4.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-10-wildcat%3AM-07.md