# Wrong variable read in checkpoint

Reads using a different key, source, or variable than the matching write, corrupting accounting

_Area: Smart contract access control and control flow. Seen in 9 disclosed reports; latest 2026-05-04. Updated 2026-10-23._

## How it works
A write records a fact under one key, source, or variable; a later read rebuilds it from a different one. The two are close enough (sibling identifiers, delta vs cumulative, source vs destination collection, coefficient vs accumulator, msg.sender vs address(this)) that code compiles and tests pass, so the mismatch survives until the wrong value feeds a safety path. The invariant broken: every read must use the same key, source, and variable the corresponding write used.

## Where it shows up
- A mapping written with keyId but read with nftId at several call sites [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-05.md)
- A checkpoint indexed by the delegator's own list instead of the delegatee's [E5](https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-11.md)
- An accumulator summing per-timestamp deltas instead of the running cumulative value [E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.13.md)
- A getter still reading the source collection after items move to a destination queue [E4](https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-02.md)
- An assignment targeting a coefficient instead of the vote accumulator it should update [E6](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.21.md)
- A running-total delta pairing the aggregate with the per-item value instead of the coefficient [E7](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.22.md)
- A burn crediting msg.sender (the LZ endpoint) instead of address(this) under delegatecall [E8](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-33.md)

## How to review
For each mapping, confirm the key domain at every read matches the definition and the write site. For each checkpoint array, confirm removal mutates the side that stores the entry. For each accumulator, confirm it sums the cumulative value, not deltas. For each moved item, confirm every accessor reads the destination. For each assignment, confirm the left-hand side is the variable whose invariant must hold, and that each term in a running-total delta pairs aggregate with coefficient and per-item value with per-item delta. In delegatecall handlers, confirm the address holding credited balances equals the address debited. In diff review, grep sibling identifiers and check every assignment's left-hand side against the intended variable. The invariant: read key, source, and variable equal the ones the write established.

## Variants seen
- Wrong identifier keying an isAave mapping, disabling liquidation [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-05.md)
- Removal reading the delegator's checkpoint, locking voting power [E5](https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-11.md)
- Delta-summed total dropping prior votes [E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.13.md)
- Getter reading source collection after move, blocking recovery [E4](https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-02.md)
- Coefficient overwritten with a vote sum, corrupting accounting forever [E6](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.21.md)
- Mismatched operand pairing in a running total [E7](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.22.md)
- Burn from the endpoint address instead of the contract, reverting all calls [E8](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-33.md)

## Impact and severity
Accounting drift and broken vote totals [E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.13.md)[E6](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.21.md)[E7](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.22.md), disabled liquidation [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-05.md), permanently locked voting power [E5](https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-11.md), blocked secret recovery [E4](https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-02.md), and a fully reverted cross-chain path [E8](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-33.md). Severity rises when the wrong read silently disables a safety path rather than reverting. E1's five call sites are the strongest signal for grep-based review.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-05.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-21.md
- E3: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.13.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-11-swafe%3AM-02.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-11.md
- E6: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.21.md
- E7: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.22.md
- E8: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-33.md