# Metric and payout evasion via forced state

Can a permissionless action move value or force state so a score, redistribution, or reward favors the attacker?

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-07-25. Updated 2026-10-23._

## How it works
A protocol computes a metric or payout from state it assumes only the legitimate actor controls. Three assumptions break: (a) a reputation score is derived from one pool's earnings, but value can be parked in a sibling pool the attacker controls, so the tracked denominator never moves; (b) an exceptional redistribution path triggers on a condition (e.g. no trove holds a volatile asset) that any caller can force by writing to a victim's position, converting it into a regular redistribution onto the victim; (c) a fixed reward per token exceeds the cheapest way to acquire that token. In each case the metric or payout reflects attacker-chosen state, not the intended one.

## Where it shows up
- Score computed from a single pool's balance/earnings, with no check on sibling pools or share skew [E1](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.12.md)
- Permissionless deposit/transfer into another user's position (trove, vault, account) [E2](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-05.md)
- Special-case branches (exceptional vs regular redistribution) reachable by forcing ordinary state [E2](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-05.md)
- Fixed reward per token with multiple acquire paths of differing cost [E3](https://bugbountylibrary.com/r/dhl%3A20250725-whereismydragontreasure.md)
- Documented invariants ("early sponsors protected", "highest staking power wins") whose formula does not match the claim [E4]

## How to review
For each metric or payout, trace what state feeds it. Invariant: no permissionless action by an unrelated party may change another party's metric inputs, force them into a special-case branch, or make a reward exceed the cheapest acquisition cost. For scores, check whether value can be parked in a self-controlled sibling pool whose config keeps the tracked denominator fixed [E1](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.12.md). For redistribution, check whether any caller can write to a victim's position and thereby flip the exceptional-vs-regular branch condition [E2](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-05.md). For rewards, enumerate every mint/acquire path, including secondary markets, and compare each cost to payout [E3](https://bugbountylibrary.com/r/dhl%3A20250725-whereismydragontreasure.md). For documented invariants, diff the comparison formula against the stated property [E4].

## Variants seen
- Reinvest earnings into a self-owned pool with skewed owner share, then withdraw, evading the trust-score penalty [E1](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.12.md)
- Permissionless deposit makes a victim's trove the sole holder of a volatile asset, redirecting exceptional bad-debt redistribution onto them [E2](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-05.md)
- Fixed legendary-card reward exceeded the cheaper recipe-redemption mint cost, draining funds [E3](https://bugbountylibrary.com/r/dhl%3A20250725-whereismydragontreasure.md)
- Sponsor bonus computed from incumbent balance and elapsed time, so a marginally larger fresh staker outranks an early sponsor [E4]

## Impact and severity
E1 lets an owner extract earnings while keeping a high trust score, undermining reputation. E2 shifts bad debt onto an innocent victim. E3 drained roughly $47k. E4 breaks the documented sponsor guarantee, enabling backrunning. Severity rises when the metric gates credit, payouts are unbounded relative to cost, or the broken invariant is a stated security property.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.12.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-05.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250725-whereismydragontreasure.md