# Iterative solver non-convergence in DeFi math

Newton solvers that oscillate, underflow, or return non-converged values instead of reverting on extreme inputs

_Area: DeFi accounting and math bugs. Seen in 5 disclosed reports; latest 2025-03-31. Updated 2026-10-23._

## How it works
Iterative numeric solvers (Newton's method, StableSwap `D`) assume the iteration converges to a fixed point within a bounded number of steps. That assumption breaks when step sizes are large relative to the quantity being solved, or when the convergence test is too loose or too strict. The solver then oscillates between two values, underflows, or exits early and returns a wrong-but-plausible number. The root cause is a mismatch between the solver's step bounds / convergence threshold and the actual magnitude of the reserves or ratios it operates on.

## Where it shows up
- Newton loops with a fixed absolute convergence threshold (e.g. `delta <= 1`) and a bare `break` on exit.
- Lookup tables feeding the solver whose `highPrice`/`lowPrice` gap or `lowPriceJ` step can exceed the reserve magnitude.
- Ports of Curve StableSwap `compute_d` that drop the revert-on-divergence branch.
- Per-element validation loops using `return` where `continue` was intended, silently skipping later elements.
- Extreme price ratios (very small or very large) as inputs to share/exchange-rate math.

## How to review
The invariant: for every input the solver accepts, it either converges to a value within tolerance or reverts; it never returns a non-converged estimate. Check that (a) the convergence branch reverts or errors on divergence, not just `break`; (b) the step bound (LUT gap, `lowPriceJ`) cannot exceed the reserve being solved; (c) the convergence threshold is tight enough to reject 2-cycle oscillation between adjacent values; (d) loops over multiple elements use `continue`, not `return`, on per-element failure. Trace extreme inputs through the solver and confirm the result matches a reference computation.

## Variants seen
- Wide LUT price bounds make step size exceed reserve, causing oscillation far from target [E1](https://bugbountylibrary.com/r/c4%3A2024-07-basin%3AM-01.md).
- Oversized `lowPriceJ` makes reserve corrections underflow or never converge [E4](https://bugbountylibrary.com/r/c4%3A2024-07-basin%3AM-02.md).
- `compute_d` returns last estimate on non-convergence instead of reverting, yielding wrong prices [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-18.md).
- Fixed `<=1` threshold defeated by ±2 oscillation, reverting and DoSing callers [E5](https://bugbountylibrary.com/r/c4%3A2024-08-basin%3AM-01.md).
- `return` instead of `continue` in a validation loop skips later valid pairs [E2](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-21.md).

## Impact and severity
Wrong reserves and prices for imbalanced or extreme pools, enabling bad swaps and mispriced liquidity [E1](https://bugbountylibrary.com/r/c4%3A2024-07-basin%3AM-01.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-18.md)[E4](https://bugbountylibrary.com/r/c4%3A2024-07-basin%3AM-02.md); DoS of dependent functions via revert [E5](https://bugbountylibrary.com/r/c4%3A2024-08-basin%3AM-01.md); skipped incentive updates causing loss of funds to lenders/borrowers [E2](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-21.md). Severity rises when the bad value is consumed by swap or accounting logic rather than only reverting.

## Why fixes fail
A bare `break` or a looser threshold hides non-convergence without fixing it; the solver still returns a wrong value [E3](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-18.md)[E5](https://bugbountylibrary.com/r/c4%3A2024-08-basin%3AM-01.md). Tightening the threshold without bounding step size can turn oscillation into a revert-based DoS [E5](https://bugbountylibrary.com/r/c4%3A2024-08-basin%3AM-01.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-07-basin%3AM-01.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-21.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-18.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-07-basin%3AM-02.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-08-basin%3AM-01.md