# Unsafe type casting of `poolValue` can malfunction the whole market

Negative poolValue from combined funding and valueChange loss casts int256 to uint256, producing ~2**255 that overflows price division and bricks the market.

- Payout: Contest reward
- Severity: medium
- Program: Float Capital
- Credited: WATCHPUG
- Disclosed: 2022-10-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-11-float-capital-judging/issues/45
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-float-capital%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** MarketCore.sol _rebalancePoolsAndExecuteBatchedActions price computation
**Root cause:** poolValue is int256 and can go negative when a 99%-capped valueChange loss combines with a ~1% funding fee; casting it to uint256 yields ~2**255, which overflows when multiplied by 1e18 in MathUintFloat.div.
**Steps:**
1. Configure funding rate ~100%/yr and EPOCH_LENGTH 4 days so per-epoch funding fee ~1% of effectiveValue.
2. Trigger a valueChange loss near the 99% cap in the same epoch.
3. poolValue at L146 becomes negative.
4. L163 `uint256 price = uint256(poolValue).div(tokenSupply)` casts negative int to ~2**255.
5. MathUintFloat.div multiplies by 1e18 and overflows, reverting _rebalancePoolsAndExecuteBatchedActions.
**How found:** Code reading of the rebalance function: noticed poolValue is int256 and can be driven negative by combining capped valueChange loss with funding fee, then traced the unchecked cast at L163 into the multiply-by-1e18 division.
**Exploitation:** Not an attacker-driven exploit; requires extreme market parameterization (long epochs, high funding rate, near-max price delta) to force poolValue negative, after which rebalancing reverts and the market halts.
**Insight:** When a signed accumulator is cast to unsigned for price/share math, check whether combined loss sources (each individually capped) can sum past 100% and flip the sign; the resulting ~2**255 then overflows downstream fixed-point multiplication.