# Price Accumulators Overflow in GTELaunchpadV2Pair contract Causes AMM-wide DoS

Uniswap V2 fork's price accumulators use checked arithmetic under Solidity 0.8, so overflow reverts _update, permanently DoSing swaps, liquidity and TWAP.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: AasifUsmani
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-20
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-20
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:regression technique:source-review vuln:dos

**Target:** GTELaunchpadV2Pair.sol AMM pair contract _update()
**Root cause:** Price accumulators (price0CumulativeLast/price1CumulativeLast) are intended to wrap around, but GTE compiles them under Solidity >=0.8 checked arithmetic, so the addition reverts at uint256.max instead of overflowing.
**Steps:**
1. Read _update() in GTELaunchpadV2Pair.sol L136-L137: `price0CumulativeLast += uint256(UQ112x112.encode(_reserve1).uqdiv(_reserve0)) * timeElapsed;`
2. Note pragma is Solidity >0.8.0, so the += is checked arithmetic
3. Observe accumulators only increase monotonically and are never reset
4. Wait until accumulator approaches uint256.max; the addition reverts
5. _update() reverts, breaking mint/burn/swap and TWAP updates
**How found:** Compared the Uniswap V2 fork against upstream: recognized Uniswap V2 deliberately lets accumulators overflow and requires unchecked blocks, then noticed GTE's pragma >0.8.0 makes the same code revert instead of wrap.
**Exploitation:** No active exploitation; the DoS occurs naturally over time as accumulators grow toward uint256.max, at which point every _update() call reverts, halting the pool.
**Insight:** When auditing forks of Uniswap V2 (or any code relying on intentional integer wraparound), check the pragma and whether overflow-dependent math is wrapped in unchecked; a version bump silently converts intended wraparound into a revert-based DoS.