# Sign errors in premium and payout math

Signed values crossing boundaries where a term is added instead of subtracted, or a positive delta used as an output

_Area: DeFi accounting and math bugs. Seen in 10 disclosed reports; latest 2026-09-23. Updated 2026-10-23._

## How it works
A formula computes a quantity with one sign convention, then passes it to a settlement or accounting step that assumes the opposite. A premium that should be a cost becomes a payout; an input delta becomes an output amount; a subtraction that should cancel nothing cancels real value. The arithmetic is locally correct, so the bug hides at the boundary between producer and consumer of the value.

## Where it shows up
- Unsigned accumulators (e.g. `accumulatedPremium * liquidity`) flowing into APIs that treat the argument as a cost via negation.
- Wrappers consuming Uniswap-V3-style signed deltas and trusting the positive input delta as the output amount.
- Proportional allocation code that divides by a share fraction instead of multiplying.
- Margin/PnL paths shared between isolated and cross margin, subtracting `initialMargin` from settled value.
- Historical balance queries using the latest checkpoint with a signed time delta instead of binary-searching epochs.

## How to review
For each value crossing a function boundary, state the sign convention on both sides and confirm they match. The invariant: a cost must reduce the payer's balance and a payout must reduce the pool's; a positive input delta must never be used where a negative output delta is required. Check proportional splits with unequal weights and capped balances. For shared margin paths, confirm the subtracted margin was actually escrowed. For historical queries, confirm the checkpoint active at the query time is selected.

## Variants seen
- Positive premium passed where a cost was expected, minting shares at pool expense [E1](https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AH-01.md).
- Positive input delta used as output amount, draining WBNB inventory [E2](https://bugbountylibrary.com/r/dhl%3A20260923-pancakev3swaphelper.md).
- Divide-by-share instead of multiply-by-share, over-compensating from index pools [E3](https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-11.md).
- `initialMargin` subtracted in cross margin, zeroing profit [E4](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-32.md).
- Negative slope term added to bias, inflating historical voting power [E5](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.13.md).

## Why fixes fail
A unit test asserted the wrong direction (assets increasing after settlement), so the sign error passed CI [E1](https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AH-01.md). Tests must assert the economic direction, not just that a call succeeds.

## Impact and severity
Direct fund loss: pool share dilution [E1](https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AH-01.md), inventory drain [E2](https://bugbountylibrary.com/r/dhl%3A20260923-pancakev3swaphelper.md), LP loss [E3](https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-11.md), user profit erased [E4](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-32.md), governance power inflation [E5](https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.13.md). Severity is high because the error is silent and repeatable; unequal weights or pre-existing balances make it worse.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AH-01.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260923-pancakev3swaphelper.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-11.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-32.md
- E5: https://bugbountylibrary.com/r/cantina%3Azerolend_jan2024%3A3.2.13.md