# Incorrect tick calculation leads to DoS

Doppler rebalance computes currentTick from per-epoch accumulatorDelta but tickLower from cumulative newAccumulator, inverting lowerSlug ticks and reverting modifyLiquidity, bricking swaps.

- Payout: Contest reward
- Severity: high
- Program: Doppler
- Credited: etherhood
- Disclosed: 2025-02-18
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_doppler.pdf#3.1.4
- Library page: https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.4
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** Uniswap v4 hook rebalance / liquidity tick computation
**Root cause:** currentTick uses only the latest accumulatorDelta while tickLower/tickUpper derive from cumulative newAccumulator, so currentTick exceeds tickLower; in lowerSlug this inverts tick ordering and modifyLiquidity reverts.
**Steps:**
1. Deploy Doppler hook with sale period and PD slugs.
2. Warp to startingTime and call `buyExactIn(hook.getMinimumProceeds()/5)` (swap 1).
3. Advance block and warp to startingTime + timeDelta/5; call `buyExactIn(hook.getMinimumProceeds()*2/5)` (swap 2).
4. Advance block and warp to startingTime + timeDelta*2/5; call `buyExactIn(hook.getMinimumProceeds())` (swap 3) — reverts in modifyLiquidity.
5. Inspect slug ticks: lowerSlug shows tickLower -67128 > tickUpper -67136, inconsistent with other slugs.
**How found:** Reviewer compared how currentTick (from accumulatorDelta) and tickLower/tickUpper (from newAccumulator) are derived in rebalance, noticed the two use different accumulator bases, and hypothesized tick inversion in lowerSlug; confirmed via a multi-swap Foundry test logging per-slug ticks.
**Exploitation:** Any user swapping after enough epochs accumulate triggers the rebalance path where currentTick > tickLower in lowerSlug, causing modifyLiquidity to revert; all further swaps are blocked until the sale period ends, denying the protocol's core function.
**Insight:** When a function derives two related bounds from different accumulator variables (delta vs cumulative sum), check monotonic ordering across epochs — a per-epoch delta paired with a cumulative sum will drift and invert tick ranges in one slug direction.