# Truncation inflates share or seize value

Integer division rounding to zero in share, rate, fee or seize math that inflates value

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-08-04. Updated 2026-10-24._

## How it works
Integer division discards the remainder. When a rate, share count, or seize amount is computed by dividing, the result rounds down. If that rounded-down value is then used to credit, burn, or subtract, the counterparty value is inflated. The broken assumption is that division preserves value: `a/b` is treated as exact, but for small `a` or coarse denominators it collapses toward zero, and any value derived from it (a share price, a supply, a fee) drifts in the attacker's favor.

## Where it shows up
- Rate or share price computed as `balance / supply` or `balance / virtualSupply` [E1](https://bugbountylibrary.com/r/dhl%3A20230827-balancer.md)
- Seize-token math in lending forks (`liquidateCalculateSeizeTokens`) [E3](https://bugbountylibrary.com/r/dhl%3A20240215-dualpools.md)
- Fee/interest math with a coarse denominator constant, or intermediate divisions like `reserves / 100` [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AH-1.md)
- A value scaled down by `10**decimals` and later multiplied back up across contracts [E4](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-05.md)
- Derived subtraction such as `vaultSupply = totalSupply - lpSupply` where `lpSupply` was truncated [E4](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-05.md)
- Caching of a computed rate across steps (e.g. batch operations) so one bad rounding persists [E1](https://bugbountylibrary.com/r/dhl%3A20230827-balancer.md)

## How to review
For every division, ask: what is the smallest nonzero result, and what happens when the numerator is tiny or the denominator coarse? The invariant to enforce: rounding must never move value toward the party who controls the inputs. Check that:
- Share/rate math rounds in the protocol's favor, or reverts below a minimum.
- Seize amounts cannot exceed collateral value for minimal collateral [E3](https://bugbountylibrary.com/r/dhl%3A20240215-dualpools.md).
- Fee denominators are fine enough that the minimum representable rate is acceptable [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AH-1.md).
- Scale-down/scale-up round trips are exact or the remainder is tracked, not dropped [E4](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-05.md).
- Cached rates are recomputed or bounded, not reused after a zero-output step [E1](https://bugbountylibrary.com/r/dhl%3A20230827-balancer.md).

## Variants seen
- Zero-output swap burns shares while paying nothing, poisoning a cached rate [E1](https://bugbountylibrary.com/r/dhl%3A20230827-balancer.md)
- Coarse denominator sets a fee floor; utilization truncated to whole percent [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AH-1.md)
- Seize-token truncation lets 2 wei of collateral back a large borrow [E3](https://bugbountylibrary.com/r/dhl%3A20240215-dualpools.md)
- Divide-then-multiply across contract boundary shrinks `lpSupply`, inflates `vaultSupply`, locks dust [E4](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-05.md)

## Impact and severity
Led to ~$2M drained from boosted pools [E1](https://bugbountylibrary.com/r/dhl%3A20230827-balancer.md), ~$42k multi-asset drain [E3](https://bugbountylibrary.com/r/dhl%3A20240215-dualpools.md), delayed liquidations and LP shortfall [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AH-1.md), and locked dust with inflated supply [E4](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-05.md). Severity rises when the rounded value feeds a cached rate or a subtraction, and when minimal inputs are cheap to repeat.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20230827-balancer.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-velar-artha%3AH-1.md
- E3: https://bugbountylibrary.com/r/dhl%3A20240215-dualpools.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-05.md