# Division before multiplication may cause division by zero DOS during low backstop supply

Division-before-multiplication in Blend's backstop valuation rounds backstop_token_to_base to zero when backstop supply is low, panicking auction creation and blocking interest/bad-debt auctions.

- Payout: Contest reward
- Severity: medium
- Program: Blend
- Credited: oakcobalt
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#m-10
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-10
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** Soroban lending pool auction module (backstop_interest_auction.rs / bad_debt_auction.rs)
**Root cause:** backstop_value_base computes `usdc.fixed_mul_floor(oracle_scalar, SCALAR_7) * 5`, dividing before multiplying, so small usdc*oracle_scalar rounds to zero; the subsequent fixed_div_floor by pool_backstop_data.tokens yields backstop_token_to_base=0, and lot/bit amount division by it panics. Oracle decimals are also unchecked at pool init.
**Steps:**
1. Deploy pool with oracle_scalar=100 (oracle decimals=2) and low backstop USDC, e.g. pool_backstop_data.usdc=50000, tokens=10_0000000
2. Compute backstop_value_base = (50000*100/1e7)*5 = 0
3. backstop_token_to_base = 0*1e7/10_0000000 = 0
4. Trigger create_interest_auction_data or create_bad_debt_auction_data; lot_amount/bit_amount divides by backstop_token_to_base -> division-by-zero panic
**How found:** Code review of the auction valuation math spotted integer division before multiplication and an unchecked oracle_scalar derived from permissionless pool constructor params; constructed a numeric example showing rounding to zero.
**Exploitation:** No attacker profit path; the flaw self-triggers when a pool's backstop supply is critically low, preventing interest auctions that would attract new backstop deposits exactly when the pool is unhealthy.
**Insight:** In fixed-point Soroban/Rust math, always multiply before dividing; audit permissionless pool constructors for unchecked oracle decimal assumptions since oracle_scalar feeds directly into valuation divisors.