# Unbounded inputs in DeFi accounting math

Caller or config numbers entering share, rate, or reward math without bounds or unit matching

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-02-19. Updated 2026-10-25._

## How it works
Accounting formulas assume their inputs sit in a range the formula was designed for. When a caller- or config-supplied number (a timestamp, a collateral amount, a decimal scale, a repeated scaling factor) enters the math without a bound or without matching the units of the formula, the output drifts from the real value. The invariant the protocol documents (value bounded by a minimum, premium tied to exposure, ratio floored at a base) silently stops holding. A related shape is duplicated math where one copy is updated and the sibling is not, so the same formula yields different numbers depending on which copy runs.

## Where it shows up
- A ratio or rate computed by linear decrement/increment with no floor or cap (time-decayed discounts, premiums).
- A divisor derived from collateral-based capacity rather than exposure alone.
- Repeated proportional scaling of a stored target and balances without a clamp.
- Duplicated math (pool vs. calculator) where one copy applies decimal/precision scaling and the other does not.
- Any formula mixing token amounts of differing decimals without an explicit precision multiplier.

## How to review
Identify every external or config input to the formula and ask: what range is this assumed to be in, and is that range enforced? Check the documented invariant and recompute it after sequences of operations, not just one call. For each ratio, confirm an explicit floor/cap exists and is reachable. For each divisor, confirm it reflects the quantity the formula intends (exposure, not collateral); concretely, deposit collateral and check whether the price paid for the same exposure changes, tracing `_getPositionRate` and its `maxPositionNotional` term [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-11.md). For duplicated math, diff sibling implementations for identical scaling, e.g. compare the pool's `get_dy` against the calculator's `get_dy` for the same precision multiplier [E2](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.4.md). The property that must hold: the computed accounting value stays within its documented bound for all admissible inputs, and inputs outside that range are rejected or clamped.

## Variants seen
- Premium/position rate divided by a collateral-derived capacity term, so deposits change the price paid [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-11.md).
- Liquidity calculator omitting decimal scaling present in the pool's copy, overinflating rewards; this is a duplicated-math omission, not an input-range issue [E2](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.4.md).
- Time-decayed auction ratio unbounded below, driving required tokens toward zero [E3](https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-23.md).

## Impact and severity
Consequences ranged from mispriced premiums [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-11.md) and overinflated rewards [E2](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.4.md) to near-total loss of basket tokens to a late settler [E3](https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-23.md). Severity rises when the unbounded input is attacker-controlled and the formula gates fund release, as with the settler in [E3](https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-23.md); it is worse when the drift compounds across repeated operations or when a fix was applied to only one copy of the math [E2](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.4.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-11.md
- E2: https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.4.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-23.md