# Ratio computed after mutation

Check whether share, NAV, or solvency ratios are computed before or after the balance they divide by is changed.

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-07-15. Updated 2026-10-29._

## How it works
A ratio (share price, NAV, bad-debt ratio, redeemable collateral) is only meaningful against a specific state. The bug is ordering: the code mutates a balance or position first, then computes the ratio from the already-changed state, so the denominator (or numerator) no longer matches the operation being priced. The result is a ratio that is internally consistent but wrong for the decision it drives.

## Where it shows up
- A transfer/pull of tokens into the contract appears before a `getTotalUnderlyingValue`-style call feeding the ratio [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.10.md).
- A buffer or multiplier applied to a delta (closable) rather than the final position [E1](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-2.md).
- Signed exposures aggregated with a per-item `Math.max(_,0)` clamp, where one component is added inside the loop and another after it [E3](https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-02.md).
- Redemption/withdrawal paths where solvency or share math runs after value moves.

## How to review
Identify the exact state the ratio is meant to describe, then confirm every input is read from that state, not a post-mutation one. The invariant: the ratio used to size a payout or bound a position must be computed from the same balances the operation started with. For buffers, verify the multiplier bounds the final ratio, not the change. For clamped sums, verify all components are clamped consistently (all inside or all outside the loop).

## Variants seen
- Buffer applied to delta instead of final position, letting redeem exceed closable [E1](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-2.md).
- Ratio computed after pulling yield tokens, inflating bad debt and shorting users [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.10.md).
- Asymmetric per-pool clamping of underlying balance producing inconsistent NAV [E3](https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-02.md).

## Impact and severity
Under-redemption of users [E2](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.10.md), leverage pushed above configured limits [E1](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-2.md), and misreported NAV [E3](https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-02.md). Severity rises when the wrong ratio feeds a payout or a risk limit, and when settled vs pending state can be desynced to realize the error [E1](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-2.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-2.md
- E2: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.10.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-02.md