# Operator: if WallSpread is 10000, operate and beat will revert and price information cannot be updated anymore

Setting wallSpread to 10000 makes lower wall price zero, causing division-by-zero in Operator._activate and permanently bricking operate/beat price updates.

- Payout: Contest reward
- Severity: medium
- Program: Olympus DAO
- Credited: zzzitron
- Disclosed: 2022-10-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-olympus-findings/issues/404
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-olympus%3AM-20
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:dos

**Target:** RANGE/Operator smart contracts (Solidity)
**Root cause:** RANGE.setSpreads permits wallSpread_ == 10000; updatePrices then computes lower wall price as movingAverage*(FACTOR_SCALE-wallSpread)/FACTOR_SCALE = 0, and Operator._activate divides by range.wall.low.price.
**Steps:**
1. Set spreads via `operator.setSpreads(7000, 10000)` as policy.
2. Set oracle price into lower cushion: `price.setLastPrice(20 * 1e18)` so currentPrice < cushion.low.price and > wall.low.price.
3. Call `operator.operate()`; _activate(false) computes `10**(oracleDecimals*2) / range.wall.low.price` where wall.low.price == 0, reverting with division by zero.
4. Heart.beat() calls operate and also reverts, freezing price updates.
**How found:** Code review of RANGE.setSpreads bounds and Operator._activate division, noticing wallSpread==10000 yields zero wall price; confirmed with Foundry PoC.
**Exploitation:** Requires privileged policy to set wallSpread to 10000; once set and price enters lower cushion, operate/beat revert permanently, leaving stale price data that other contracts may consume, potentially enabling swaps against stale upper wall.
**Insight:** When a percentage/spread parameter feeds a divisor as (SCALE - param), check the boundary where the divisor becomes zero; setters bounding at `> 10000` rather than `>= 10000` leave a DoS edge.