apegurus/share-accounting-desynchronization

<!-- Source: BailSec audit reports (CC0) -->

Share Accounting Desynchronization Vulnerabilities

Overview

Share-accounting desynchronization appears when a protocol tracks ownership in shares but exposes user actions, approvals, rewards, or integrations in asset-denominated values without guaranteed synchronization. If share supply, token supply, and fee accrual are updated at different times or with inconsistent caps, attackers and edge cases can exploit the mismatch to bypass approvals, drain value, lock funds, or break reward accounting.

Unlike a single arithmetic bug, this is a system-level failure of consistency across view logic, state updates, and transfer semantics.

Common Patterns

• Approval consumption and transfer amount are evaluated in different units.
• View functions use theoretical future supply while state-changing paths use capped or delayed supply updates.
• Reward accumulators assume minted fees that are not actually minted.
• Rounding strategy differs across conversion helpers, causing exploitable drift in repeated operations.

Detection Heuristics

• Map all conversions between shares and assets, then verify consistent rounding direction by context.
• Compare view-only paths (pending, preview, realBalance) against state-changing mint/burn/update behavior.
• Check behavior when fee collector address changes, updates are delayed, or supply caps are hit.
• Fuzz with long periods of inactivity, then sudden updates to detect discontinuities.

Examples from Audits

• Share transfer path that could bypass token-amount approval checks under specific conversion outcomes.
• Reward preview functions allocating value from uncapped or unminted fees, creating inconsistent accumulator states.
• Systems where stale supply updates or abrupt fee-recipient changes altered debase/reward behavior and destabilized accounting.

Remediation

Adopt a single canonical accounting model and centralize conversions in audited helper functions with documented rounding policy. Enforce that view and state paths share the same cap logic and fee-mint assumptions. Add invariant tests ensuring assets <-> shares coherence under updates, pauses, and collector changes. When conversions can become stale, force synchronization before sensitive operations or require bounded slippage from callers. This reduces drift accumulation and makes behavior predictable for integrations.