# Mint spread collateral-less and conjuring collateral claims out of thin air with implicit arithmetic rounding and flawed int to uint conversion

Implicit round-down in QuantMath mul/div and abs-style intToUint let attacker mint credit spreads with zero collateral and claim phantom collateral from Rolla Controller.

- Payout: Audit contest
- Severity: high
- Program: Rolla
- Found by: rayn
- Disclosed: 2022-06-24
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-03-rolla-findings/issues/31
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-rolla%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** QuantMath/SignedConverter fixed-point math libraries in Controller collateral logic
**Root cause:** QuantMath.mul/div truncate via integer division before explicit toScaledUint rounding, and SignedConverter.intToUint returns abs(a) instead of reverting on negatives, so collateral requirement can round to zero and claimable collateral can flip sign.
**Steps:**
1. Create option A strike 10^9+1 (8 dec) and option B strike 10^9 (8 dec) vs 1 WETH.
2. Mint 1 wei (10^-18) of option A paying 1 wei.
3. Mint 1 wei spread B collateralized by A: Y1=(X2-X1)*1e27//X2=99999999000000000, Y2=Y1*1e9//1e27=0, so collateral Z=0.
4. To extract: mint 10^9+2 wei spreads separately (each zero-fee), then neutralize all at once so Y2=1e9 and Z=1 wei returned.
5. Alt path: mint long option, mint short spread collateralized by long, wait expiry with longStrike>expiry>shortStrike, claim; intToUint(abs) on negative returnableCollateral yields payout.
6. Choose longStrike=1e14-1, shortStrike=1, expiry=1e14-2, amount=1e28 so B1=-2000000001 and Z=2 wei claimed.
**How found:** Code review of QuantMath.toScaledUint revealed explicit rounding only helps if inputs retain full precision; inspecting mul/div showed implicit truncation, and reading intToUint showed it is abs() in disguise, used in calculateClaimableCollateral.
**Exploitation:** Attacker mints a credit spread whose collateral requirement rounds to zero due to mul truncation, then neutralizes many small spreads at once so the explicit round-down still returns >=1 wei per batch, or uses the abs() intToUint in claimCollateral to convert a negative returnableCollateral into a positive payout after expiry lands in a narrow predicted band.
**Escalation:** Batching many 1-wei spread mints before a single neutralize amortizes gas; profit scales with capital in the claimCollateral path.
**Insight:** When a protocol has an explicit round-up/round-down helper, audit every upstream mul/div for silent truncation that defeats it; also check 'conversion' helpers that actually implement abs() — sign flips in claimable-collateral math turn negative balances into payouts.