# Aggregate norm gates hide symmetric divergence

Gates that sum squared distances from a center instead of bounding the worst individual deviation

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-03-09. Updated 2026-10-29._

## How it works

A gate reduces many values to one aggregate — typically a sum of squared distances from a center (median or mean) — and compares it to a threshold. The assumption is that a small aggregate means every individual value is close to where it should be. That breaks when inputs are symmetric: two values equally far on opposite sides of the center contribute the same squared distance, and the aggregate stays under the threshold while the real divergence of each value is large. The gate passes a state that a per-value bound would reject.

## Where it shows up

- Solvency or safety gates that sum squared distances from a median or mean and compare to a squared threshold [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-18.md)
- A sibling function that checks pairwise divergence (|a - b| > limit) while the gated function does not [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-18.md)
- Any place a single scalar norm stands in for a vector of positions, ticks, or balances
- A gate whose threshold is squared (MAX^2) but whose inputs are not individually bounded

## How to review

The invariant: the gate must be at least as strict as the worst individual deviation, not just the aggregate. Check that every value entering the norm is also bounded individually, or that the norm is a max rather than a sum. Compare the gated function against its siblings and ask why one uses pairwise divergence and the other an aggregate [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-18.md). Confirm the threshold is compared against the quantity that actually bounds each input, not a quantity that can be reduced by cancellation.

## Variants seen

- Squared-norm gate bypassed by symmetric tick offsets around the median [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-18.md)

## Impact and severity

Insolvent positions passing solvency checks [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-18.md). Severity rises when the gate is the only barrier before liquidation or settlement, and when the cancelling inputs can be set by the party being checked.

## Why fixes fail

Not shown in the evidence.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AM-3.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-18.md