# Missing refund or rollback on failure

Value leaves before the matching input or credit is secured, and failure paths never restore the debit

_Area: Smart contract access control and control flow. Seen in 6 disclosed reports; latest 2026-05-18. Updated 2026-10-23._

## How it works
A contract moves value in two steps: it pays out or debits one side, then collects or credits the other. The code assumes the second step succeeds, or that the first step is bounded by what the caller actually put in. When that breaks — the second step reverts, the caller never deposited, or the payout can be reused to source the owed input — the imbalance is never corrected. Example: a swap sends USDC to the recipient, then collects WETH in a callback; the recipient uses the USDC to buy the WETH elsewhere and keeps the spread [E3](https://bugbountylibrary.com/r/dhl%3A20260518-tesseraswap.md). The invariant that should hold: at every point, value out is bounded by value in, and any failure path restores the debit.

## Where it shows up
- Output transferred before input is collected in the same call or callback [E3](https://bugbountylibrary.com/r/dhl%3A20260518-tesseraswap.md)
- Refund of "excess" input not checked against the caller's actual deposit or locked balance [E5](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.1.md)
- Source-chain balance decremented at initiate; destination credit can revert with no refund path [E8](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.2.md)
- Refund transfer placed before a revert that forwards the error, so the revert unwinds the refund [E4](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-23.md)
- Ledger side deliberately left untracked, but a path can still create a tracked entry for it [E1](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md)
- Async slot/counter incremented before the fallible step, released only on success [E6](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.10.md)

## How to review
Trace every value movement and ask, for each debit or payout, what restores it if the matching credit or collection fails. Check refunds are bounded by recorded deposits (lockedFunds-style accounting), not the requested amount [E5](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.1.md). For two-phase flows, confirm the credit phase has a revert-safe refund on the debit side [E8](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.2.md). For callbacks, confirm input is collected before output is released, or that release cannot fund the owed input [E3](https://bugbountylibrary.com/r/dhl%3A20260518-tesseraswap.md). For refund-then-revert paths, confirm the refund survives the revert (pull-based) [E4](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-23.md). For counters, confirm every acquire has a release on all exit paths including early returns [E6](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.10.md). This differs from reentrancy: the bug is a missing compensating action on a failure path, not reordered external calls.

## Variants seen
- Payout-before-collection in a swap callback, spread captured [E3](https://bugbountylibrary.com/r/dhl%3A20260518-tesseraswap.md)
- Unbounded refund of excess bid draining registry [E5](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.1.md)
- Debit on source with no rollback on destination failure [E8](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.2.md)
- Refund rolled back by the same revert that signals failure [E4](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-23.md)
- Self-referential remote deploy creates tracked entry on an untracked side, DoS [E1](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md)
- Slot leak on early error return deadlocks the service [E6](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.10.md)

## Impact and severity
Ranged from full registry drain and permanent fund loss [E5](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.1.md)[E8](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.2.md) to locked bridged funds [E4](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-23.md), bridge DoS [E1](https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md), and prover halt [E6](https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.10.md). Severity rises when the failure is permissionless and repeatable, and when no admin recovery exists.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-08-axelar-network%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-03.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260518-tesseraswap.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-23.md
- E5: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.1.md
- E6: https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.10.md
- E7: https://bugbountylibrary.com/r/c4%3A2023-10-party%3AM-01.md
- E8: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.2.md