# Calc.boundedAdd used intitally but later regular subtraction used

GMX MarketUtils uses boundedAdd for funding amount per size but plain subtraction/negation later, so int256.min overflows and MarketDecrease orders revert.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: stent
- Disclosed: 2023-04-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-gmx-judging/issues/269
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** GMX Synthetics MarketUtils funding calculation (Solidity)
**Root cause:** Funding amount per size is clamped via Calc.boundedAdd to type(int256).min, but getFundingFeeAmount later negates/subtracts it with plain arithmetic, overflowing on int256.min.
**Steps:**
1. Call MarketDecrease flow reaching MarketUtils.getNextFundingAmountPerSize with inputs like `(type(int256).min+10, -12)`
2. boundedAdd clamps result to `type(int256).min` instead of reverting
3. Continue call path to MarketUtils.getFundingFeeAmount, which negates/subtracts the clamped value
4. Plain `-` on `type(int256).min` overflows, reverting the order
**How found:** Code reading: noticed boundedAdd used to defend overflow in getNextFundingAmountPerSize, then traced downstream call path and found getFundingFeeAmount uses regular subtraction/negation, inconsistent with the defensive intent.
**Insight:** When a codebase clamps arithmetic to avoid reverts, audit every downstream consumer of the clamped value for operations (negation, subtraction, multiplication) that reintroduce overflow on the boundary value like int256.min.