# Unsorted or inverted denom ratio mispricing

Ratio or price math fed by caller-ordered denoms or mismatched pool cardinality, silently inverting or mispricing

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-03-31. Updated 2026-10-29._

## How it works
Price and slippage math assumes its inputs are in a canonical form: two tokens, sorted denoms, and a curve that matches the pool's actual cardinality. When a caller-controlled path (pool creation, parameter omission) breaks that assumption, the ratio comparison silently inverts or the formula is applied to the wrong number of assets. No error is raised; the contract just computes a wrong number and acts on it.

## Where it shows up
- Pool creation that stores denoms in caller-supplied order while deposits are always sorted [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-12.md)
- Length or type guards living inside an optional-parameter branch, skipped when the parameter is omitted [E1](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-01.md)
- Swap/pricing formulas hardcoded for 2 tokens applied to pools with 3+ assets [E1](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-01.md)
- Piecewise curves where parameters switch at a threshold but the swap routine re-evaluates the whole input under the post-crossing parameter [E2](https://bugbountylibrary.com/r/c4%3A2021-11-bootfinance%3AH-04.md)
- Helpers that assume sorted inputs with no enforcement at the call site [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-12.md)

## How to review
Identify every ratio, price or slippage computation and trace each input back to its source. The invariant: any value used in ratio math must be normalized (sorted, correct cardinality, correct curve segment) before comparison, and that normalization must be enforced on the path that produces it, not assumed. Check that guards are not gated behind optional branches. For piecewise curves, confirm the trade is split at the boundary rather than recomputed wholesale. Instrument the comparison to confirm ordering matches expectation.

## Variants seen
- Permissionless creation accepts unsorted denoms, inverting the slippage ratio and draining LPs [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-12.md)
- Optional slippage parameter skips the 2-token guard, allowing broken multi-token CPMM pools [E1](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-01.md)
- Trade crossing a curve target price uses only the new amplifier for the entire trade [E2](https://bugbountylibrary.com/r/c4%3A2021-11-bootfinance%3AH-04.md)

## Impact and severity
Mispriced execution and LP drainage via arbitrage [E1](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-01.md)[E2](https://bugbountylibrary.com/r/c4%3A2021-11-bootfinance%3AH-04.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-12.md). Severity is high: permissionless entry points and silent math errors mean no privileged access is needed, and the wrong number looks valid to downstream code.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-01.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-11-bootfinance%3AH-04.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-12.md