# Stale or wrong variable used

A value read at use time that no longer matches the object acted on: live stake, index, clock, cached domain

_Area: Smart contract access control and control flow. Seen in 8 disclosed reports; latest 2026-02-26. Updated 2026-10-23._

## How it works
A function acts on a value that no longer matches the object it targets. Two shapes: (a) stale content — the variable is read at use time from live state (current stake, current time, current config) instead of the state at the relevant past moment; (b) wrong variable selected — a sibling or parameter value is forwarded to the sink while the correct one sits unused. The broken assumption is that a pointer, index, clock, or cached field still refers to the same content it did when scheduled, computed, or signed. The code reads correctly by name and type; only the content is wrong. The drift window is anything between scheduling/signing and use: reorgs, front-runs, later timestamps, admin config changes, or state transitions the user triggers.

## Where it shows up
- Penalty/slashing checks reading live stake or balance rather than stake at infraction time [E1](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.3.md).
- On-chain references by index (parentIndex) rather than content hash or position [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-optimism-2024%3AM-4.md).
- A calldata field rewritten from a prior step's output while a sibling field (native value) keeps the static value [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.3.md).
- Maturity/lock end recomputed as `block.timestamp + duration` instead of stored creation time + duration [E4](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.8.md).
- A callback forwarding its scheduled round parameter instead of the payload's own round [E5](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-06.md).
- Per-user snapshotted state (cooldownEnd) trusted after the global setting it derived from is disabled [E6](https://bugbountylibrary.com/r/c4%3A2023-10-ethena%3AM-03.md).
- A cached value (DOMAIN_SEPARATOR) computed before its dependency (name) is initialized, never recomputed [E7](https://bugbountylibrary.com/r/c4%3A2023-09-centrifuge%3AM-03.md).

## How to review
For each value reaching a sink, ask: is it derived from the actual object acted on, or from a live pointer/clock/config that can drift? Diff the variable that reaches the sink against the one populated by the check or payload. The invariant: every action binds to the identity of its target (hash, stored creation time, payload's own round, finalized domain fields), not to a mutable pointer or live read. For cached values, confirm all dependencies are set before caching and recomputed when they change.

## Variants seen
- Live stake read at slash time, evadable by opt-out [E1](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.3.md).
- Index-based claim reference swapped by reorg [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-optimism-2024%3AM-4.md).
- Static sibling field not rewritten with dynamic amount [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.3.md).
- Timestamp recomputed from current time, drifting forward [E4](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.8.md).
- Callback forwards timer round instead of vote round [E5](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-06.md).
- Stale per-user snapshot ignores disabled global config [E6](https://bugbountylibrary.com/r/c4%3A2023-10-ethena%3AM-03.md).
- Cached domain separator built before name set [E7](https://bugbountylibrary.com/r/c4%3A2023-09-centrifuge%3AM-03.md).

## Impact and severity
Slashing evasion [E1](https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.3.md), bond theft [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-optimism-2024%3AM-4.md), broken swaps [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.3.md), votes for farms past real unlock [E4](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.8.md), misrouted votes degrading liveness [E5](https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-06.md), users locked past disabled cooldown [E6](https://bugbountylibrary.com/r/c4%3A2023-10-ethena%3AM-03.md), broken permit integrations [E7](https://bugbountylibrary.com/r/c4%3A2023-09-centrifuge%3AM-03.md). Severity rises when the stale value gates funds, penalties, or safety checks.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.1.3.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-optimism-2024%3AM-4.md
- E3: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.2.3.md
- E4: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.8.md
- E5: https://bugbountylibrary.com/r/c4%3A2025-09-monad%3AM-06.md
- E6: https://bugbountylibrary.com/r/c4%3A2023-10-ethena%3AM-03.md
- E7: https://bugbountylibrary.com/r/c4%3A2023-09-centrifuge%3AM-03.md