# Reward index scaling direction bug

Scaling factors meant to slash or clamp applied as division or after a floor, inflating rewards

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-05-23. Updated 2026-10-23._

## How it works
A scaling factor (a WAD index, a multiplier, a target ratio) is meant to reduce a value after a loss or to cap it at a floor. The code applies the wrong operation or the wrong order: it divides by a sub-1e18 index instead of multiplying, or it multiplies a value after clamping it to a floor. The assumption that breaks is that the factor only ever shrinks the quantity. When the factor is reused in unrelated accounting, one loss silently compounds into a second penalty, or a floor gets scaled up so the effective target drifts.

## Where it shows up
- A slash/scale index that starts at 1e18 and only decreases, then appears in `divWadDown`/`divWadUp` [E1](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.3.md)
- The same index consumed as a multiplier in reward-weight or total-weight math [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md)
- A clamp-to-target step followed by a variable multiplier (e.g. 1e18-2e18) [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26.md)
- Reward weight, target weight, or total weight computed from a loss-adjusted index
- Ordering of clamp vs. multiply in yield distribution

## How to review
For every scaling factor, state its intended direction and range, then check the operation matches: a factor in (0,1e18] that should reduce a value must be multiplied, not divided. Assert monotonic invariants: after a loss, `rewardWeight <= _rewardWeight` and total weight must not grow [E1](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.3.md). Trace every consumer of a slash index; if it feeds reward weights, confirm a single loss does not shrink weight beyond the actual loss [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md). For clamp-then-multiply, verify the multiplier applies to the actual balance, not the clamped floor, so the effective target does not scale with the multiplier [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26.md).

## Variants seen
- Division by a sub-1e18 slash index inflating reward weight after losses [E1](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.3.md)
- Slash index reused as a multiplier in total reward weight, double-penalizing a slashed module [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md)
- Bonding multiplier applied after clamping to target ratio, doubling the ratio's effect [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26.md)

## Impact and severity
Overclaimed rewards drain protocol funds [E1](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.3.md); unfairly reduced future rewards for a penalized module [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md); overpayment to locked holders at the expense of other stakers [E3](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26.md). Severity is high where the inflated quantity is directly claimable; worse when the same index feeds multiple accounting paths, compounding the error.

## Why fixes fail
Fixing one operation direction does not address the index being reused elsewhere; both the division [E1](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.3.md) and the multiplier reuse [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md) must be corrected together, or the loss still compounds.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.3.md
- E2: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.6.md
- E3: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26.md