# Wrong operand or direction in bounds checks

Guards comparing delta not absolute, reversed operands, or abs() hiding sign, letting bad values pass

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-04-10. Updated 2026-10-23._

## How it works
A guard is meant to constrain a value, but it constrains the wrong quantity or the wrong side of a comparison. It may compare a relative delta instead of the absolute result, subtract operands in reversed order, or take an absolute value that erases sign. The guard then passes for inputs it was meant to reject, and downstream logic acts on an out-of-bounds or wrong-signed value.

## Where it shows up
- Bounds checks written as `new - old <= MAX` where the intent is `new <= MAX` [E3](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-03.md)
- `abs(x)` compared to a limit, then a positive constant assigned regardless of `x`'s sign [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-1.md)
- Delta math mixing `balanceOf` and `getReserves` in the wrong order [E2](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-03.md)
- Any guard whose operands are two similar-looking variables (sender vs receiver, balance vs reserve, old vs new)

## How to review
Identify the invariant the guard must enforce and confirm the compared expression equals it. For a cap on an absolute quantity (expiration, balance, timestamp), the absolute value must be checked, not a delta [E3](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-03.md). For sign-sensitive amounts, confirm the sign survives the check and the assigned value matches the intended direction [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-1.md). For delta math, verify operand order matches the intended formula [E2](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-03.md).

## Variants seen
- Delta check instead of absolute bound, making the assert tautological [E3](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-03.md)
- Absolute-value comparison that flips sign of a negative amount [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-1.md)
- Reversed subtraction in liquidity adjustment enabling donation griefing [E2](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-03.md)

## Impact and severity
Ranged from forced over-spending of user tokens [E2](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-03.md) to bypassing a hard cap [E3](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-03.md) and letting an attacker manipulate hedge pricing to drain vault funds [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-1.md). Severity rose where the wrong value fed directly into fund movement or pricing rather than only reverting; E1's direct drain is the strongest anchor.

## Why fixes fail
No incomplete or regressed fixes appear in the evidence.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-1.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-03.md