# Tick bounds vs price bounds mismatch

Two related bounds derived from different accumulators or unaligned ticks, breaking ordering or liquidity math

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-02-18. Updated 2026-10-23._

## How it works
A function needs two bounds that must stay consistent: a tick range and the price/liquidity derived from it, or a lower and upper tick. The bug is that each bound is computed from a different source — a per-epoch delta versus a cumulative sum, or raw MIN/MAX sqrt prices versus tickSpacing-aligned ticks. The two sources drift apart, so the bounds no longer describe the same range. The broken assumption is that "these two numbers refer to the same thing." They don't, and downstream math (ordering, liquidity, price step) silently goes wrong.

## Where it shows up
- A function that mixes a per-epoch `accumulatorDelta` with a cumulative `newAccumulator` to build related bounds [E2](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.4.md).
- Liquidity computed from `MIN_SQRT_PRICE`/`MAX_SQRT_PRICE` but minted at ticks aligned to `tickSpacing` [E3](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.2.6.md).
- Price-step logic that branches on one epoch's net flow while ignoring cumulative sold volume [E1](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.1.md).
- Any place a tick is derived, then a sqrt price or liquidity is derived separately for the same position.

## How to review
Trace every bound back to its source variable and confirm both bounds use the same one. The invariant: for a position, `tickLower < currentTick < tickUpper` must hold after computation, and the sqrt prices used for liquidity must equal the sqrt prices of the exact aligned ticks used for minting. For price adjustment, confirm the per-epoch branch cannot override cumulative supply state. Check monotonic ordering across epochs when delta and cumulative values are combined [E2](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.4.md).

## Variants seen
- Per-epoch delta paired with cumulative sum inverts tick ordering, reverting `modifyLiquidity` and bricking swaps [E2](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.4.md).
- Unaligned sqrt-price constants used for liquidity while minting at aligned ticks, unbalancing bond vs sold amounts [E3](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.2.6.md).
- Epoch net-flow branch applies max price drop despite cumulative oversold, crashing price [E1](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.1.md).

## Impact and severity
Led to DoS (swaps bricked) [E2](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.4.md), mispriced initialization [E3](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.2.6.md), and maximal price crash from a single zero/negative-net epoch [E1](https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.1.md). Severity rises when the mismatch is reachable in normal operation and blocks core flows; cumulative-state bugs are worse because one bad epoch persists.

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.1.md
- E2: https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.4.md
- E3: https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.2.6.md