# Operator precedence and sign math bugs

Check parentheses, precedence, and sign handling in fixed-point formulas against the intended algebra

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2023-06-20. Updated 2026-10-29._

## How it works
A formula is written so that the arithmetic does not match the intended algebra. Multiplication binds tighter than addition, so a constant offset or divisor lands on the wrong term; or a sign/abs step is dropped so negative inputs take a different branch. The code compiles and returns a number, so nothing fails loudly — the magnitude or sign is just wrong. The broken assumption is that the written expression equals the intended one; it only does if every term is grouped and signed as intended.

## Where it shows up
- Fixed-point formulas mixing a scale constant (WAD, BASE_DIVISOR) with `exp`, sums, or differences.
- Accumulator updates of the form `(existing + delta) / divisor` where only `delta` should be scaled.
- Ported math (papers, reference implementations) with polynomial terms, `abs`, or sign branches.
- Price adapters, fee accrual, mint/burn amount calculators, reward curves.
- Any expression where a reviewer must mentally re-derive grouping to know the result.

## How to review
Rewrite each formula algebraically and compare to the intended equation term by term. The invariant: every constant offset, divisor, and scale factor must apply to exactly the term the spec says, and sign handling must match for negative inputs. For accumulators, check that repeated calls converge to the intended value, not decay by the divisor each time. For ported formulas, diff symbol by symbol against the source and trace callers to confirm the affected inputs (negative values, large pools) are reachable.

## Variants seen
- Missing parentheses around a scaled exponential: `scalingFactor*e^x - WAD` instead of `scalingFactor*(e^x - WAD)`, skewing auction prices by `scalingFactor-1` [E1](https://bugbountylibrary.com/r/sherlock%3A2023-06-Index%3AM-2.md).
- Divisor applied to the whole `(existing + fee)` sum instead of just the fee, repeatedly dividing the pool by 1e10 and locking tokens [E2](https://bugbountylibrary.com/r/c4%3A2022-03-biconomy%3AH-03.md).
- Omitted `abs()` in an arctan polynomial, diverging from the reference for negative inputs and miscomputing mint/burn amounts [E3](https://bugbountylibrary.com/r/c4%3A2021-05-fairside%3AH-08.md).

## Impact and severity
Wrong magnitudes propagate into prices, fees, and mint/burn amounts. E1 skews every auction price; E2 drains an incentive pool to zero and locks funds; E3 miscomputes FSD amounts for reachable negative inputs. Severity is high where the error compounds per call (E2) or affects all users of a pricing path (E1). Worse when the wrong value is silent and accumulates rather than reverting.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-06-Index%3AM-2.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-03-biconomy%3AH-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-05-fairside%3AH-08.md