# Reward numerator denominator asset mismatch

Check reward/share math where numerator and denominator use different asset sets, units, or scaling.

_Area: DeFi accounting and math bugs. Seen in 10 disclosed reports; latest 2026-05-18. Updated 2026-10-23._

## How it works
A ratio (reward per stake, share price, redemption weight) is only meaningful if numerator and denominator measure the same thing in the same units. The bug is a mismatch: the numerator counts one asset set, boost, or scaling while the denominator counts another. The ratio then silently over- or under-states value, and the contract mints, pays out, or redeems the wrong amount. Nothing reverts; the arithmetic is valid, only the accounting assumption ("these two totals describe the same pool") is false.

## Where it shows up
- A `stakedOf`/`balanceOf`-style numerator that sums multiple assets or applies a boost, paired with a `totalStaked`/`totalSupply` denominator covering only one asset.
- Reward emission formulas derived from Synthetix-style staking where numerator and denominator are computed in separate functions.
- "Minimum fee/interest" fallback branches that split a fixed total across positions.
- Any `totalX` that is supposed to equal the sum of per-user `x`, but adds a raw count to a weighted sum.
- Boosts or multipliers applied on one side of a division only.

## How to review
The invariant: the denominator must equal the sum of the numerator's terms over all users, in the same units and scaling. Concretely, check that `totalStaked`/`totalWeight` is computed from exactly the same asset set, boosts, and scaling as the per-user numerator. For fee/interest splits, confirm the split is proportional to each position's amount, not an equal per-position share. For any aggregate total, verify it is literally the sum of the per-user quantities it divides.

## Variants seen
- Numerator sums borrowed EUSD+PeUSD with a boost; denominator is EUSD totalSupply only, inflating minted rewards [E1](https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AM-04.md).
- Minimum-interest branch splits equally per position instead of proportional to amount, so padding positions dilutes honest lenders [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-kairos%3AM-3.md).
- Raw reserved-token count added to a contribution-floor-weighted redemption sum, skewing payouts [E3](https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AH-03.md).

## Impact and severity
Over-minting of rewards [E1](https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AM-04.md), yield theft from legitimate lenders [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-kairos%3AM-3.md), and skewed redemption payouts [E3](https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AH-03.md). Severity rises when the mismatch is permissionless to trigger (self-loans, padding positions) and when the inflated quantity is directly mintable or withdrawable. Silent, non-reverting errors make it worse: no alarm fires and drift compounds over time.

## Why fixes fail
Evidence does not show incomplete or regressed fixes for these reports.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AM-04.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-02-kairos%3AM-3.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AH-03.md