# State overwrite with weaker value

Writes that replace a max, accumulated, or pending value with a default, lower, or reassigned one

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-04-10. Updated 2026-10-23._

## How it works
A state variable is meant to hold a monotonic or accumulated safety value: the highest paused tier, the running average, the full set of pending events. A later write path assigns a weaker value instead of combining with the existing one — a plain assignment where a max, append, or accumulate was required. The earlier, stronger state is silently lost, so a guard that depended on it no longer holds. The assumption that breaks: that every write site preserves the invariant the variable encodes.

## Where it shows up
- Assignment (`x = new`) to a variable that elsewhere is only raised, appended, or maxed.
- Liquidation, exit, or timeout paths that write a tier, average, or challenge set.
- A variable reassigned between two check/compute calls before being forwarded to a sink.
- Clamp-to-zero or reset branches reachable because a companion counter was not updated.
- TODO comments doubting a branch is reachable — treat as a hint it is.

## How to review
Enumerate every write site of the variable and confirm each preserves the intended invariant: paused tier must be `max(old, new)`; running average must be updated on both add and remove; pending event sets must be appended, not replaced. Trace which variable is actually passed to the sink, not just which are computed. The property: after any sequence of operations, the stored value is at least as strong as any value previously written.

## Variants seen
- Exit path updates participant count but not the average, so the average only grows and a clamp-to-zero branch zeroes the cumulative [E1](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-21.md).
- Event handler reassigns the challenge set from a second check, dropping discrepancy events before dispatch [E2](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AH-01.md).
- Liquidation assigns the borrower's tier directly instead of the max, unpausing higher tranches [E3](https://bugbountylibrary.com/r/c4%3A2023-11-betafinance%3AM-03.md).

## Impact and severity
Led to governance/staking monopoly [E1](https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-21.md), malicious executor proposals going unchallenged [E2](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AH-01.md), and bypass of a withdraw guard [E3](https://bugbountylibrary.com/r/c4%3A2023-11-betafinance%3AM-03.md). Severity rises when the overwritten value gates funds or governance power, and when the weaker write is reachable by an ordinary low-privilege action.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-21.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-11-betafinance%3AM-03.md