# Fee divisor uses wrong aggregate base

Fee or rate divided by an aggregate denominator while settlement or pricing applies to a narrower subset

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2024-05-22. Updated 2026-10-23._

## How it works
A fee, funding amount, or rate is computed by dividing a total by a denominator that does not match the set of positions that will later settle against it. The numerator is shared across everyone, but the divisor is broader (or narrower) than the settlement set. Per-unit values get diluted or inflated, so what payers contribute and what claimers receive no longer balance. The pool absorbs the difference.

## Where it shows up
- A `...PerSize` or per-unit value divided by total open interest, total supply, or total notional, while settlement is restricted to a subset (e.g. positions with a specific collateral) [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-20.md).
- Pricing or spread formulas dividing by a capacity term derived from collateral, so depositing collateral changes the price for unchanged exposure [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-11.md).
- Config values that double as both a parameter and an enable/disable flag, where the disabled state (0) feeds a divisor [E2](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-20.md).
- Any place a derived value is used as a divisor without checking it can be zero or mismatched.

## How to review
Identify every fee/rate computation and ask: does the denominator equal exactly the set of accounts that will settle against this value? The invariant: sum of amounts charged to payers must equal sum of amounts claimable, and the denominator must cover the same population as the settlement. For pricing formulas, check that user-controlled deposits cannot move the price of the same exposure [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-11.md). For config flags, trace every downstream use of the derived value, especially divisors, and confirm the disabled state cannot reach them [E2](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-20.md).

## Variants seen
- Funding per-size divided by total OI instead of collateral-specific OI, diluting pay while claims stay full [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-20.md).
- Collateral factor set to 0 to delist, zeroing a value used as a divisor in liquidation and health checks [E2](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-20.md).
- Position rate divided by a capacity term scaled by free collateral, letting LPs lower the premium by depositing [E3](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-11.md).

## Impact and severity
E1 drained the pool as payers underpaid relative to claims. E2 broke liquidations and core functions, reverting them. E3 let users pay reduced premiums for full exposure. Severity rises when the mismatch is repeatable and the pool or protocol absorbs the shortfall; user-controllable inputs that shift the denominator make it worse.

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-20.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-20.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-11.md