# Exchange: totalFunding calculation should be done with a simple multiplication operation instead of a wadMul operation

Exchange multiplied per-second funding rate by raw time delta using wadMul, dividing by 1e18 and zeroing totalFunding, corrupting mark price and funding updates.

- Payout: Contest reward
- Severity: high
- Program: Polynomial Protocol
- Credited: carlitox477
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/101
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AH-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Exchange.sol funding rate / mark price math
**Root cause:** wadMul divides by 1e18, but the time delta (block.timestamp - fundingLastUpdated) is a plain integer, not an 18-decimal wad, so totalFunding is scaled down by 1e18 and effectively becomes zero.
**Steps:**
1. Read Exchange.getMarkPrice: fundingRate = fundingRate / 1 days yields per-second rate in wad.
2. Observe totalFunding = wadMul(fundingRate, currentTimeStamp - fundingLastUpdatedTimestamp) divides by 1e18.
3. Note time delta is not wad-scaled, so result is ~0 for realistic intervals.
4. Same pattern in _updateFundingRate corrupts normalizationFactor.
5. Propagates to mark price, liquidations, collateral checks, LP pricing.
**How found:** Code review of wad math: recognized wadMul assumes both operands are 18-decimal wads, but a timestamp difference is a plain integer, so the implicit /1e18 is wrong.
**Escalation:** Bug affects openTrade, closeTrade, addCollateral, removeCollateral, liquidate, KangarooVault pricing, ShortCollateral liquidation checks, and LiquidityPool order fees via corrupted mark price.
**Insight:** When auditing fixed-point math, check every wadMul/wadDiv operand's scaling: raw timestamps, token amounts with non-18 decimals, and ratios are common sources of accidental 1e18 scaling errors that silently zero out values.