# Rounding-to-zero accounting bugs

Integer division truncating rates, shares or rewards to zero while state still advances

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-07-25. Updated 2026-11-01._

## How it works
Fixed-point math assumes a computed rate, share count or reward increment is a meaningful positive number. Integer division breaks that assumption: when the numerator is smaller than the denominator, the result truncates to 0. The code then treats 0 as valid state — a zero slippage floor, a zero reward increment, a zero share balance — and downstream checks or invariants that depend on a nonzero value silently pass or break.

## Where it shows up
- Rate math of the form `(a * scale) / b` where `a * scale` can be less than `b` (extreme price ratios, low-decimal tokens) [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-oku-trade-order-types%3AM-1.md).
- Reward-per-token accrual using raw token decimals, where `rate * elapsed / totalStaked` rounds down to 0 but `lastUpdated` still advances [E2](https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md).
- ERC4626-style `convertToShares`/`convertToAssets` with asymmetric rounding (up on one side, down on the other) [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-17.md).
- Any `minAmountReceived`, slippage floor, or threshold derived from a rate that can be 0 [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-oku-trade-order-types%3AM-1.md).
- Permissionless calls that reset an accrual timestamp or trigger a state transition [E2](https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md).

## How to review
Check the invariant: whenever a rate, share or reward value is consumed as a bound or divisor, it must be provably nonzero for all reachable inputs, or the code must revert. Specifically:
- For each division, ask whether the numerator can be smaller than the denominator; if so, is a 0 result handled?
- Confirm a zero-derived slippage floor cannot disable a `require` [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-oku-trade-order-types%3AM-1.md).
- Confirm reward accrual cannot advance `lastUpdated` while adding 0 to the accumulator [E2](https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md).
- Confirm `totalAssets > 0` cannot coexist with `totalSupply == 0` after rounding [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-17.md).
- Check whether an attacker can drive the state (deposit 1 wei, call permissionless upkeep) to force the zero case.

## Variants seen
- Rate truncates to 0, zeroing `minAmountReceived` and bypassing slippage protection; attacker-controlled keeper txData completes the theft [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-oku-trade-order-types%3AM-1.md).
- Per-token reward increment rounds to 0 on frequent updates, discarding accrued rewards; a 1-wei deposit griefs all stakers [E2](https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md).
- Round-up withdraw zeroes total shares while assets remain, so `convertToShares` returns 0 and `deposit` reverts, bricking the pool [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-17.md).

## Impact and severity
Fund theft [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-oku-trade-order-types%3AM-1.md), permanent loss of staker rewards [E2](https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md), and permanent denial of service on deposits [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-17.md). Severity rises when the zero state is attacker-reachable via permissionless calls or attacker-supplied data, and when it is persistent rather than transient.

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-07-oku-trade-order-types%3AM-1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-17.md