# Unchecked arithmetic wraps accounting

Unchecked or narrow-width math on balances, shares, accumulators or user prices that can wrap

_Area: DeFi accounting and math bugs. Seen in 35 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
Accounting code assumes intermediate values stay inside the integer type. When an `unchecked` block, pre-0.8 Solidity, a narrow fixed-width type (uint16, i128, u128), or a decimal type is used on balances, shares, accumulators, or user-supplied prices, the value can wrap to zero or to max instead of reverting. The stored bookkeeping then no longer matches reality: a cost becomes near-free, a reward becomes enormous, or a sum reverts and bricks a path. Checked math is the default from Solidity 0.8, so only explicit `unchecked`, assembly, pre-0.8 code, and narrow fixed-width types are in scope.

## Where it shows up
- `unchecked { ... }` around share/asset math, PnL, or reward accumulators.
- User-supplied prices (take-profit, stop-loss, trigger) flowing into arithmetic.
- Fixed-width fields read from external protocols (e.g. Uniswap V3 `observationCardinality`, `currentIndex` as uint16) summed together.
- `PRECISION * accumulated / supply` patterns where the product is computed before division.
- Bonding-curve price numerators multiplying amount, reserve and totalSupply in pre-0.8 code.
- Batch aggregation multiplying per-submitter values by weights without bounds.

## How to review
For every arithmetic path touching balances, shares, or accumulators, identify the type width and the maximum realistic input. The invariant: for all reachable inputs, each intermediate product/sum must stay within the type, or the code must use checked math, wider types, or a full-precision mulDiv (multiply in a wider intermediate, then divide; naive reordering loses precision). Check that user-controlled values are bounded before entering math, and that config parameters feeding accumulators are capped. For fixed-width fields read from external contracts, cast to a wider type or compare against the type max before summing. Trace rounding: amounts that round to zero individually but not when summed.

## Variants seen
- Pre-0.8 bonding-curve price numerator wraps to zero, minting tokens free [E1](https://bugbountylibrary.com/r/dhl%3A20260109-truebit.md).
- Unchecked PnL with attacker take-profit price mints tokens [E2](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-03.md).
- uint16 overflow in observation index sum bricks rebalance [E3](https://bugbountylibrary.com/r/sherlock%3A2025-02-yieldoor%3AH-3.md).
- Unchecked `shares * DECIMALS` in previewMint mints shares for 1 wei [E4](https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AH-02.md).
- Unchecked limb in a circuit reduction gate forges outputs [E5](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-05.md).
- i128 overflow in AMM constant-product numerator reverts swaps [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-22.md).
- u128 overflow in reward-per-share accumulator locks funds [E7](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.3.md).
- Unbounded submitter value overflows decimal multiply, aborting a batch [E8](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-14.md).

## Impact and severity
Ranged from free token minting and vault drainage [E1](https://bugbountylibrary.com/r/dhl%3A20260109-truebit.md)[E2](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-03.md)[E4](https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AH-02.md) to permanent fund lockout [E7](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.3.md) and DoS of swaps, rebalances or reward batches [E3](https://bugbountylibrary.com/r/sherlock%3A2025-02-yieldoor%3AH-3.md)[E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-22.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-14.md). Severity rises when the wrapped value is user-controlled and directly sets payout or cost, and when no bound exists on config parameters feeding the accumulator.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260109-truebit.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-03.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2025-02-yieldoor%3AH-3.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-04-panoptic%3AH-02.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-05.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-22.md
- E7: https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.3.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-14.md