# Stale or zero share pricing reads

Share/NAV math reading cached, staticcall, or zeroed values instead of live state

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-06-27. Updated 2026-11-01._

## How it works
Share or NAV math assumes every value it reads is live and correct. When one input is a cached rate, a `staticcall` that silently fails and returns zero, or a value clamped in the wrong place, the price per share is computed from something other than reality. Interest credited, shares minted, or NAV reported then diverge from true state, and the drift compounds.

## Where it shows up
- A config parameter (e.g. reserve factor) feeding both an index update and a treasury accrual in one function, where one path uses a cached derived rate and the other the fresh argument [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AM-9.md)
- `staticcall` against a gauge function that looks view-only but mutates state internally (e.g. checkpoint), reverting and returning 0 [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-09.md)
- Aggregation of signed exposures with a per-item `Math.max(_,0)` clamp, where one component is folded in inside the loop and another added after it [E3](https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-02.md)

## How to review
- For each value in share/NAV math, trace its source: live storage, cache, or external call. All inputs to one pricing computation must come from the same state snapshot.
- Check every `staticcall` target: does it internally write storage? If so the read is unsafe, and its failure must not default to zero.
- For clamped aggregations, confirm every component is clamped the same way (all inside or all outside the loop).
- Invariant: credited value and reported NAV must derive from one consistent rate; no component may be added before a clamp that others are added after.

## Variants seen
- Cached derived rate vs freshly fetched parameter in the same accrual function [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AM-9.md)
- Staticcall on a state-mutating "view" returning 0, underpricing shares [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-09.md)
- Asymmetric per-pool clamp: underlying balance folded inside vs outside the loop [E3](https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-02.md)

## Impact and severity
Inconsistent treasury accrual and index updates risking pool insolvency [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AM-9.md); underpriced shares enabling reward theft [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-09.md); inconsistent NAV mispricing [E3](https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-02.md). Severity is high where drift compounds across users or lets one party extract value from others.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-06-new-scope%3AM-9.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-09.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-02.md