# _calculateRewards() in PirexGmx don't handle reward calculation properly, and it would revert when totalSupply() is zero which will cause claimRewards() to revert if one of 4 rewardTracker's totalSupply was zero

PirexGmx._calculateRewards divides by RewardTracker.totalSupply() without a zero check, reverting claimRewards/harvest/claim when any of four GMX trackers has zero supply.

- Payout: Contest reward
- Severity: medium
- Program: Redacted Cartel
- Credited: unforgiven
- Disclosed: 2023-01-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-redactedcartel-findings/issues/237
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AM-10
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:dos

**Target:** PirexGmx.sol reward calculation / GMX RewardTracker integration
**Root cause:** The ported GMX reward math computes (blockReward * precision) / r.totalSupply() without guarding totalSupply() == 0, unlike GMX's own _updateRewards which checks supply > 0.
**Steps:**
1. Note PirexGmx._calculateRewards computes cumulativeRewardPerToken = r.cumulativeRewardPerToken() + ((blockReward * precision) / r.totalSupply()).
2. Observe claimRewards() calls _calculateRewards four times (gmx/glp base and esGMX trackers).
3. Cause any of the four RewardTracker totalSupply() to be zero (e.g. empty staking pool).
4. Call PirexRewards.claim() or harvest(), which invokes PirexGmx.claimRewards() and reverts on division by zero.
**How found:** Compared the copied GMX reward math in PirexGmx against GMX's own RewardTracker._updateRewards, noticing GMX guards with `if (supply > 0 && blockReward > 0)` while the port omits the zero-supply check.
**Exploitation:** No attacker profit path; the flaw is a liveness/DoS condition where reward harvesting and user claims revert while a tracker's totalSupply is zero.
**Insight:** When a protocol re-implements upstream reward math, diff it line-by-line against the original: guards like zero-supply checks in the source are easy to drop and turn into division-by-zero DoS on the whole claim path.