# Unset config defaults to zero

Config keys never settable or never finalized silently default to zero, zeroing payouts or accounting

_Area: DeFi accounting and math bugs. Seen in 11 disclosed reports; latest 2026-02-05. Updated 2026-10-23._

## How it works
A value that accounting depends on is read from a config store, registry, or dictionary, but nothing ever sets it. The read returns the type's default (zero), and the arithmetic that follows silently produces zero or a wrong rate. The broken assumption is that "the key exists and was configured"; in practice an unsettable key, a missing finalize, or a wrong chain constant means the value is never what the code assumes.

## Where it shows up
- A payout or rate is multiplied by a factor read from a DataStore/registry; check the key is whitelisted in the setter [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-10.md).
- One registry array consumed by multiple contracts with conflicting required contents [E2](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AM-08.md).
- Chain-specific constants (blocksPerYear, block time) copied from a fork's origin chain [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AH-01.md).
- Cairo `default_dict_new` without a matching `default_dict_finalize`, or a copy helper deriving `default_value` from prover-supplied data [E1](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-03.md)[E5](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md).

## How to review
For every value read from config/registry/dict, trace where it is written and confirm a reachable setter exists and the key is allowed. Invariant: every read key has a live write path, and every dict opened is finalized before reassignment. For forks, diff chain constants against the target chain. For registries, enumerate each consumer's required contents and confirm they agree.

## Variants seen
- Unsettable config key defaults to zero, blocking claims [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-10.md).
- Shared registry array with contradictory contents, zeroing collateral value [E2](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AM-08.md).
- Wrong chain constant inflating rates 5x [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AH-01.md).
- Copy helper trusts prover-supplied default value [E1](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-03.md).
- Dict reassigned without finalize, leaving prior entries unconstrained [E5](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md).

## Impact and severity
High: users permanently cannot claim collateral [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-10.md), collateral silently uncounted [E2](https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AM-08.md), rates 5x off [E3](https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AH-01.md), or forged outputs accepted by a prover [E1](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-03.md)[E5](https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md). Severity rises when the zero value is multiplied into a payout or when a prover can supply the default.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-04-dyad%3AM-08.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-05-venus%3AH-01.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-10.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-09-kakarot%3AH-04.md