# Unscaled reserves in pool math

Pool, reward, or oracle math mixing raw amounts with differently scaled values; check every comparison and constant for unit consistency

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-05-18. Updated 2026-10-25._

## How it works
Pool, reward, and oracle math assumes every amount entering a formula is expressed in the same unit and scale. When one side of a calculation is left in raw token units (or a hardcoded raw constant) while the other side is scaled — by decimals, a virtual price, or a percentage basis — the result is off by orders of magnitude. The arithmetic itself looks fine; the assumption that both operands share a scale is what breaks.

## Where it shows up
- Swap or conversion paths that scale one direction but not the reverse (token->LP vs LP->token).
- Comparisons between a derived value scaled to a fixed precision (e.g. 1e16) and a raw integer (e.g. a percent).
- Hardcoded raw-unit constants (e.g. 1e10) used as rewards or seeds across tokens with different decimals.
- Reimplementations of a reference protocol in another language or style, where math was transcribed rather than forked.
- Sibling contracts (two oracles, two pools) that normalize differently.

## How to review
For every formula, trace each operand back to its source and confirm the scale matches the other operands and the output. The invariant: any two values compared, added, or multiplied must carry the same unit and decimal scaling, and any constant must be expressed relative to the token's decimals rather than as a raw number. Diff asymmetric paths (A->B vs B->A) line by line; diff sibling implementations for missing normalization. Check hardcoded constants against every token the function can receive.

## Variants seen
- Missing virtual-price scaling on the token-to-LP swap path, mispricing LP tokens vs underlying [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-saddle-finance-april-2022.md).
- Oracle derivation scaled to 1e16 compared against raw-percent slippage, off by 1e14, causing reverts [E2](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-04.md).
- Hardcoded 1e10 raw reward units inflating incentives for low-decimal tokens [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-03.md).

## Impact and severity
Severity ranges from fund drain (~$11m in [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-saddle-finance-april-2022.md)) to protocol-funded overpayment [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-03.md) to denial of service blocking migration [E2](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-04.md). Worse when the mispriced path is reachable in a loop or with flash liquidity [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-saddle-finance-april-2022.md), or when the constant applies to many tokens [E3](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-03.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-saddle-finance-april-2022.md
- E2: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-04.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-03.md