# Unbounded or negative amount panics

Signed amounts reaching coin or arithmetic constructors without sign or bound checks, causing panics

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2024-06-24. Updated 2026-10-24._

## How it works
A caller-supplied amount is treated as trusted numeric input. The code compares it against a balance or feeds it into a formula, but never checks its sign or magnitude. A negative value passes a balance guard like `amount <= staked` because a negative is trivially less than a positive balance. The value is then stored and later handed to a constructor or arithmetic that cannot represent it. The result is a panic or underflow, not a clean rejection, so it aborts shared execution rather than just the caller's request.

## Where it shows up
- Message handlers accepting signed integers (`Amount`, `stake`, `value`) with no `>= 0` check before storage.
- Balance guards of the form `amount <= staked` that a negative value satisfies.
- Stored amounts later passed to `sdk.NewCoin`/`NewCoins` or similar constructors inside `EndBlocker`/`BeginBlocker`.
- Scheduling formulas that multiply a per-phase period by cumulative supply, where the product grows across phases instead of resetting.

## How to review
Trace every user-supplied amount from the entry point to its first use in a constructor, arithmetic, or subtraction. The invariant: any value reaching a panic-capable constructor or a subtraction must be validated for sign and bound at the boundary, and re-validated where consumed if it was stored. Ask: can a caller make this value negative, zero, or larger than any real balance, and does the failure reject cleanly or abort shared execution? For scheduling, confirm per-phase state resets rather than accumulating.

## Variants seen
- Negative stake removal queued via message handler, panicking coin construction in EndBlocker and halting the chain [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-3.md).
- Cumulative-supply time multiplier pushes computed mint time past `block.timestamp`, underflowing and bricking minting [E3](https://bugbountylibrary.com/r/c4%3A2023-10-nextgen%3AH-04.md).

## Why fixes fail
A balance comparison is not a sign check; negative values pass it [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-3.md). Validating at entry but storing the raw value leaves the panic path open at consumption time.

## Impact and severity
Severity ranges from a full chain halt [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-3.md) to permanent denial of a sale path [E3](https://bugbountylibrary.com/r/c4%3A2023-10-nextgen%3AH-04.md). Worse when the bad value is stored and consumed later in a shared block path, so one caller's input stops everyone, and when the failure is a panic rather than a revert scoped to the caller.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-3.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-woofi-solana-deployment%3AH-1.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-10-nextgen%3AH-04.md