# ConcentratedLiquidityPool: rangeFeeGrowth and secondsPerLiquidity math needs to be unchecked

ConcentratedLiquidityPool's checked arithmetic on rangeFeeGrowth/secondsPerLiquidity reverts on legitimate negative feeGrowthInside, bricking positions and reward claims.

- Payout: Audit contest
- Severity: high
- Program: Sushi
- Found by: hickuphh3
- Disclosed: 2021-11-30
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-2-findings/issues/13
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident-2%3AH-14
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** ConcentratedLiquidityPool / ConcentratedLiquidityPoolManager Solidity contracts
**Root cause:** Uniswap V3-style fee growth math legitimately produces negative feeGrowthInside (relative values matter, not absolute), but the implementation uses checked subtraction, so valid states revert on underflow.
**Steps:**
1. Set price at parity (nearestTick=0), tickSpacing=10, feeGrowthGlobal increments by 1 per tick moved.
2. At nearestTick=40, Alice mints position over uninitialised ticks [-20,30]; their feeGrowthOutside=40.
3. nearestTick moves to 50; Bob mints [20,30]; tick 20 uninitialised gets feeGrowthOutside=50, tick 30 keeps 40.
4. Compute rangeFeeGrowth(20,30): feeGrowthBelow=50, feeGrowthAbove=50-40=10, feeGrowthInside=50-50-10=-10.
5. Checked subtraction reverts, blocking position updates/collect and reward claims.
**How found:** Reasoned from Uniswap V3 fee-growth semantics: feeGrowthInside is a relative quantity that can legitimately go negative, so checked arithmetic is wrong; constructed a concrete tick scenario to demonstrate the underflow.
**Insight:** When porting Uniswap V3 fee/seconds accounting, feeGrowthInside and secondsInside deltas are intentionally allowed to underflow; audit every subtraction in rangeFeeGrowth, rangeSecondsInside, _updatePosition, collect, claimReward and getReward for unchecked blocks.