# VE3DLocker.sol Wrong implementation of inversely traverse for loops always reverts

VE3DLocker's inverse for-loops ported from Convex 0.6.12 underflow under Solidity 0.8.7, making totalSupplyAtEpoch, balanceAtEpochOf, pendingLockAtEpochOf and totalSupply always revert.

- Payout: Contest reward
- Severity: medium
- Program: veToken Finance
- Credited: WatchPug
- Disclosed: 2022-10-25
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-vetoken-findings/issues/150
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-vetoken%3AM-26
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:regression technique:source-review vuln:accounting-error vuln:dos

**Target:** VE3DLocker.sol locker contract (Solidity 0.8.7)
**Root cause:** Inverse loops use `i + 1 != 0` / `locks.length - 1` idioms that relied on 0.6.12 silent underflow; Solidity 0.8.x reverts on underflow, so loops revert at i==0 or when locks.length==0.
**Steps:**
1. Read VE3DLocker.sol totalSupplyAtEpoch/balanceAtEpochOf/pendingLockAtEpochOf/totalSupply loops.
2. Note loop condition `for (uint256 i = _epoch; i + 1 != 0; i--)` decrements to i==0 then `i--` underflows.
3. Note `for (uint i = locks.length - 1; ...)` underflows when locks.length==0.
4. Compare to Convex CvxLockerV2 compiled with 0.6.12 where underflow wraps silently.
5. Call any of these view functions; observe revert.
**How found:** Code review comparing ported Convex locker logic against the Solidity version bump to 0.8.7; recognized 0.8 breaking change on arithmetic underflow makes the inverse-traversal idiom revert.
**Escalation:** Judge notes tokenizedLocks integrating strategies would be bricked and Snapshot governance unusable since user balance at epoch cannot be queried.
**Insight:** When a protocol ports battle-tested code (e.g. Convex) across a Solidity major version, audit every arithmetic idiom that depended on silent overflow/underflow—especially `i + 1 != 0` reverse loops and `length - 1` on possibly-empty arrays.