# Rounding to zero in share math Floor division yielding zero shares, debt, or rate then consumed as valid state _Area: DeFi accounting and math bugs. Seen in 123 disclosed reports; one confirmed bounty: $100,000; latest 2026-08-20. Updated 2026-10-23._ ## How it works Share, exchange-rate and reward math divides one scaled quantity by another and floors the result. When the numerator is small relative to the denominator, the quotient is zero. The code then treats that zero as legitimate: it mints zero shares for real assets, accepts a zero scaled amount, or lets a check pass vacuously. The broken assumption is that integer division always yields a meaningful nonzero quantity and that a zero result is harmless. The invariant that must hold: a nonzero input never produces a zero output that is then consumed as valid state. ## Where it shows up - Assets divided by exchange rate or scaled amounts by an index, floor-rounded, with no zero-share or min-amount check [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-dfx-finance-rounding-error-bugfix-review.md)[E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-11.md). - Reward-per-share accumulators where pending rewards times precision factor is below totalShares [E2](https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md)[E7](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-16.md). - Vaults where totalAssets rises without minting shares (direct mint, donation), so previewDeposit floors to zero [E3](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md). - Withdraw conversions that round up, leaving totalAssets > 0 with totalSupply == 0 [E4](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-17.md). - Fixed-point invariant functions (e.g. `_k()`) that round to zero at tiny reserves, making the check vacuous [E5](https://bugbountylibrary.com/r/sherlock%3A2024-06-velocimeter%3AM-1.md). ## How to review For every division, take the smallest plausible numerator and largest denominator and ask whether the quotient can be zero. Worked example: `amount_ = (_amount * 1e6) / _rate` with a 2-decimal token and a large rate floors to 0 while LP tokens still mint [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-dfx-finance-rounding-error-bugfix-review.md). For reward accumulators, compare the precision factor against the smallest-decimal reward token and the largest plausible totalShares: with PRECISION_FACTOR=1e12, USDC rewards truncate to zero once totalShares exceeds pendingRewards*1e12 [E7](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-16.md). For vaults, enumerate every external path that can raise totalAssets without minting shares (public donation, deposit_for on linked escrows, direct mint) and confirm shares-minted > 0 is enforced [E3](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md). A zero is benign only if rejected or ignored downstream; it is exploitable if any branch treats it as a valid amount, valid debt, or satisfied invariant. Check that zero-share mints revert, zero scaled amounts are rejected, and dust-cleanup or `<=1` branches cannot turn a truncation into a full state wipe [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-11.md). Confirm invariant checks are non-vacuous at small reserves [E5](https://bugbountylibrary.com/r/sherlock%3A2024-06-velocimeter%3AM-1.md). ## Variants seen - Deposit transfer rounds to zero while LP tokens still mint [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-dfx-finance-rounding-error-bugfix-review.md). - Zero scaled repay triggers dust-cleanup that erases full debt [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-11.md). - Reward accumulator truncates to zero, stranding payouts [E2](https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md)[E7](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-16.md). - totalAssets inflated without shares, so deposit mints zero shares [E3](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md). - Round-up withdraw leaves assets with zero supply, bricking deposits (mirror case) [E4](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-17.md). - Fixed-point invariant rounds to zero at tiny reserves, passing vacuously [E5](https://bugbountylibrary.com/r/sherlock%3A2024-06-velocimeter%3AM-1.md). ## Why fixes fail Evidence shows fixes that add rounding helpers without auditing upstream mul/div still truncate [E3](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md), and guards on one path miss the dust-cleanup branch that converts zero into a wipe [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-11.md). ## Impact and severity Outcomes range from stranded rewards [E2](https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md)[E7](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-16.md) to full loss of depositor principal [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-dfx-finance-rounding-error-bugfix-review.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md)[E8](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md), debt wiped for near-zero payment [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-11.md), and a bricked pool [E4](https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-17.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-06-velocimeter%3AM-1.md). Severity rises when the zero state is reachable by a single actor and persists, and when downstream special-case branches amplify a truncation into a full state change. ## Evidence - E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-dfx-finance-rounding-error-bugfix-review.md - E2: https://bugbountylibrary.com/r/sherlock%3A2025-03-symm-io-stacking%3AH-1.md - E3: https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md - E4: https://bugbountylibrary.com/r/sherlock%3A2024-08-sentiment-v2%3AM-17.md - E5: https://bugbountylibrary.com/r/sherlock%3A2024-06-velocimeter%3AM-1.md - E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AH-11.md - E7: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-16.md - E8: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md