# Zero-initialized accounting accumulators

Min/max or delta accumulators seeded at zero, or sentinel values never reset, skewing selection and amounts

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-07-15. Updated 2026-11-01._

## How it works
An accumulator that drives a later decision is initialized to a fixed value (usually zero) or set to a sentinel (an "infinite" weight) and never recomputed. The code then assumes the accumulator reflects the real data. When the data does not straddle that seed value — all deltas same sign, or a full redemption already happened — the selection or amount derived from the accumulator is wrong. The assumption that breaks: that zero is a neutral starting point for a min/max search, and that a sentinel written once will be cleared before reuse.

## Where it shows up
- Min/max search loops where `maxDelta`/`minDelta` start at `0` rather than type min/max [E3](https://bugbountylibrary.com/r/c4%3A2021-06-gro%3AH-04.md)
- Multi-branch functions where one variable is first a constraint, then a derived base, and only some branches reassign it [E1](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-4.md)
- Accumulator state written with an "infinite"/saturation sentinel that is never reset on later calls [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.7.md)
- Any index or amount chosen from an accumulator that can be left at its seed value

## How to review
For each accumulator, ask: what inputs make every candidate fall on one side of the seed? For min/max, the invariant is that the seed is strictly outside the possible range (type min/max), so the first candidate always wins. For constraint-then-derived variables, the invariant is that every branch reassigns the variable to the derived value after the constraint check [E1](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-4.md). For sentinels, the invariant is that the sentinel is cleared or the branch is unreachable on subsequent calls [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.7.md). Trace the accumulator to every downstream use of the index or amount.

## Variants seen
- Zero-seeded min/max delta ordering producing duplicate or out-of-range indexes [E3](https://bugbountylibrary.com/r/c4%3A2021-06-gro%3AH-04.md)
- Constraint value left in place instead of recomputed to collateral*price, underpaying a bond by (1-BFP) [E1](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-4.md)
- Saturation sentinel never reset, so later partial redemptions over-credit and wrongly reduce debt [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.7.md)

## Impact and severity
Wrong vault selection causes withdrawals from the wrong vault or reverts [E3](https://bugbountylibrary.com/r/c4%3A2021-06-gro%3AH-04.md); mispriced bond rewards underpay kickers [E1](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-4.md); over-credited redemptions wrongly reduce user debt [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.7.md). Severity rises when the bad value feeds fund movement or debt accounting rather than a display, and when sequences (not single calls) trigger it.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-4.md
- E2: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.7.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-06-gro%3AH-04.md