# Missing claim wrapper strands surplus value

Value accrues to a contract but no function exists to withdraw or claim it

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-02-17. Updated 2026-10-23._

## How it works
A contract receives or accrues value (surplus collateral, refunds, snapshotted balances) that is meant to be paid out later, but the code path that would move it out is missing, misdirected, or left open to reversal. The assumption that breaks is "accrued value has a reachable exit." Either no wrapper calls the underlying protocol's claim function, the recipient address is wrong, or an outflow path stays open after a snapshot, so the recorded obligation and the actual balance diverge.

## Where it shows up
- Adapter/connector contracts integrating a lending or CDP protocol: check every value-extraction entrypoint (claim, redeem, withdraw-surplus) is wrapped.
- Cross-chain payloads with address fields (`from`, refund, recipient) set from `msg.sender` on the source chain.
- Contracts that snapshot `balance` into a funding/payout total at close, while refund/withdraw remains callable.
- Native-token handling where `receive()` is disabled or refunds route to a fixed address.

## How to review
For each place value can accrue, trace a concrete exit path to a real recipient. The invariant: every credited balance has a callable function that transfers it to the intended party, and no outflow can reduce a balance below an already-recorded payout obligation. For cross-chain fields, confirm the recipient address is valid on the destination chain (deterministic deployment or explicit user-supplied refund address), not a source-chain `msg.sender`.

## Variants seen
- Refund `from` field set to source-chain adapter, so destination-chain failure refunds go to a wrong/nonexistent address [E1](https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-03.md).
- Balance snapshotted at `closeCompetition` but deposits remain refundable, letting funding drop below the recorded total [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-5.md).
- Connector omits a wrapper for the underlying `claimCollateral()`, so recovery-mode surplus is permanently stuck [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-09.md).

## Impact and severity
Permanent loss or lock of user or protocol funds; in E2, winner payouts are bricked entirely. Severity is high because the value is unrecoverable without an upgrade, and native-token or cross-chain paths remove any fallback recovery.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-03.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-5.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-09.md