# Missing consumed flag allows repeat payout

Value-moving path checks eligibility but never marks the request spent, so the same call pays again

_Area: Smart contract access control and control flow. Seen in 10 disclosed reports; latest 2026-09-21. Updated 2026-10-23._

## How it works
A path that moves value out checks eligibility but never records that the action happened. The guard reads state (a claim mapping, an offer record, a limit counter, a signature) that the same path fails to update, clear, or bind to single use. The assumption "a successful payout means the request is now spent" is never enforced in code, so the same request passes the check and pays again. The invariant: every value-moving path must leave the request's eligibility state false, and any counter must be symmetric across increment and refund paths.

## Where it shows up
- A mapping read in a `require`/`if` but never assigned afterward in the same function [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-union-finance-update-2%3AH-2.md).
- Payout branches (e.g. `amount == 0`, boundary values) that skip the cleanup the normal branch runs [E1](https://bugbountylibrary.com/r/dhl%3A20260921-doingud.md).
- Counters incremented on request but not decremented on withdraw/reject/refund [E2](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AM-2.md).
- Signature-gated purchase/claim functions with no nonce or consumed-terms tracking [E5](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AM-01.md).
- Claim functions with no eligibility or already-claimed check at all [E6](https://bugbountylibrary.com/r/dhl%3A20240215-babyloogn.md).
- Per-user contribution amounts paid out but never zeroed or flagged [E4](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-16.md).
- Claim guards keyed on a user-supplied recipient (`_to`) rather than `msg.sender` [E7](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-03.md)[E8](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-07.md).

## How to review
1. For every path that moves value out, name the exact state write that marks the request consumed.
2. Confirm that write executes on all branches, including boundary and error branches.
3. Grep for mappings read in a `require` but never assigned; each is a candidate [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-union-finance-update-2%3AH-2.md).
4. For signature-gated functions, confirm one validation binds the signature to single use (nonce or consumed-terms mapping); expiry alone is insufficient [E5](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AM-01.md).
5. For per-user payout functions, confirm contribution state is zeroed or a claimed flag set after transfer [E4](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-16.md).
6. Confirm claim guards are keyed to `msg.sender`, not a caller-supplied recipient [E7](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-03.md)[E8](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-07.md).
7. For limit counters, trace every refund/withdraw path and confirm the counter decrements symmetrically [E2](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AM-2.md).
False-positive risk: some guards intentionally rely on external accounting or a separate settlement contract; confirm no other component marks the request spent before flagging.

## Variants seen
- Offer record never deleted on the zero-amount branch, replayable; also missing an `offerer != msg.sender` check [E1](https://bugbountylibrary.com/r/dhl%3A20260921-doingud.md).
- Claim mapping read but never written, so the limit check always passes [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-union-finance-update-2%3AH-2.md).
- Limit counter incremented but not decremented on refund/reject (griefing DoS, not theft) [E2](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AM-2.md).
- EIP-712 private-sale signature reusable until expiry, no consumed-terms tracking [E5](https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AM-01.md).
- Airdrop claim with no eligibility or already-claimed validation [E6](https://bugbountylibrary.com/r/dhl%3A20240215-babyloogn.md).
- Migration payout never zeroes per-user contribution [E4](https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-16.md).
- Claim mapping keyed on recipient `_to` instead of `msg.sender`, bypassable by varying `_to` [E7](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-03.md)[E8](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-07.md).

## Impact and severity
Repeatable payout empties escrow or faucet balances directly [E1](https://bugbountylibrary.com/r/dhl%3A20260921-doingud.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-union-finance-update-2%3AH-2.md)[E6](https://bugbountylibrary.com/r/dhl%3A20240215-babyloogn.md)[E7](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-03.md)[E8](https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-07.md). Asymmetric counters let one large holder block all other users (DoS, not theft) [E2](https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AM-2.md). Severity rises when the repeat is cheap and needs no access check [E1](https://bugbountylibrary.com/r/dhl%3A20260921-doingud.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-union-finance-update-2%3AH-2.md)[E6](https://bugbountylibrary.com/r/dhl%3A20240215-babyloogn.md), and when the asset is escrowed, since a temporary shortfall becomes permanent [E1](https://bugbountylibrary.com/r/dhl%3A20260921-doingud.md). Note: E6's evidence lacks a "how found" detail.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260921-doingud.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-04-aegis-op-grant%3AM-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-06-union-finance-update-2%3AH-2.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-16.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AM-01.md
- E6: https://bugbountylibrary.com/r/dhl%3A20240215-babyloogn.md
- E7: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-03.md
- E8: https://bugbountylibrary.com/r/c4%3A2022-02-concur%3AH-07.md