# Zero divisor reverts in DeFi accounting

Divisors (liquidity, price, rate) that can reach zero, and CPI calls presenting zero-liquidity states

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-08-21. Updated 2026-10-29._

## How it works
Accounting math assumes a divisor (liquidity, price, precision-scaled rate) is always positive. When a reachable edge state drives it to zero, the operation either reverts (locking the path) or silently produces a wrong result. The assumption that breaks: "the denominator is nonzero whenever this code runs." Nothing enforces it, and the edge state is often created by the caller's own logic or by a legitimate end-of-life condition.

## Where it shows up
- Division by liquidity, price, or a decaying auction price with no `>0` guard before the divide.
- A redundant third-party DEX CPI call made after your own code has already driven a position to zero liquidity, where the callee rejects that state [E1](https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-03.md).
- Circuit/constraint code that conditionally zeroes outputs for a special case but still enforces the algebraic relation [E2](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-06.md).
- Price formulas subtracting a cumulative step decrease from a precision constant without bounding the result [E3](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.4.md).

## How to review
For every divisor, ask: what is the minimum value this can take across all reachable states, including edge states your own code creates? The invariant: any value used as a divisor must be provably `>0` at that point, or the branch must be handled explicitly. For CPIs, read the callee's guards and confirm your call cannot present a state it rejects (e.g. zero liquidity), and check whether the call is even needed [E1](https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-03.md). For constrained math, confirm the relation enforcing outputs is disabled under the same condition that zeroes them [E2](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-06.md). For decaying prices, check cumulative decrease against the precision constant within max duration, and treat the negative case as the real risk, not just zero [E3](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.4.md).

## Variants seen
- Redundant zero-liquidity CPI revert permanently locking the last unit [E1](https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-03.md).
- Div-by-zero making a transaction unprovable, DoSing a queue [E2](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-06.md).
- Unguarded auction-price divisor reaching zero or negative, mispricing collateral [E3](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.4.md).

## Why fixes fail
E1 shows a redundant call added on top of one that already updates fees; removing the extra call, not guarding it, is the fix. Guarding a divisor without bounding the cumulative input [E3](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.4.md) leaves the negative case open.

## Impact and severity
Permanent lock of funds [E1](https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-03.md), chain-level DoS [E2](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-06.md), and collateral mispricing from a tiny bid [E3](https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.4.md). Severity is high: edge states are reachable in normal operation, and the failure is silent or total.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AH-06.md
- E3: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.4.md