# Oracle cumulative arithmetic reverts

Checked math or sentinel max values on cumulative oracle prices that revert and brick dependent logic

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2023-11-13. Updated 2026-10-23._

## How it works
Oracle code often relies on arithmetic that was designed to wrap, or on sentinel values (like a max price) that downstream math cannot absorb. When the same code runs under checked arithmetic (Solidity 0.8+), or when a sentinel max flows into a sum or average, the operation reverts instead of producing a usable number. The broken assumption is that cumulative or extreme oracle values are safe to add, subtract, average or divide. They are not: the result is a hard revert that blocks every caller.

## Where it shows up
- Vendored Uniswap-style oracle/TWAP libraries compiled under pragma >=0.8, where comments say "overflow is desired" [E3](https://bugbountylibrary.com/r/c4%3A2022-04-phuture%3AH-02.md)
- Cumulative price accumulators added without `unchecked` blocks [E3](https://bugbountylibrary.com/r/c4%3A2022-04-phuture%3AH-02.md)
- Oracle consumers doing `(low + high) / 2`, `FIX.plus`, or similar on values that may be `FIX_MAX` [E1](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-08.md)
- Price functions returning a sentinel max with a nonzero low when an upstream oracle times out [E1](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-08.md)
- Unbounded `cumulativePrice` divided by an average, used as a weight in slippage checks [E2](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-12.md)

## How to review
For each arithmetic op on oracle values, ask: can either operand reach a sentinel max, or can the sum exceed the type width? The invariant: every cumulative add/sub and every average or sum of oracle prices must either be wrapped intentionally (`unchecked`) or bounded so it cannot overflow. Trace sentinel returns (`FIX_MAX`, timeout values) through every consumer, not just the producer. For TWAP weights, confirm the accumulator is windowed or bounded so the average can still track the market [E2](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-12.md).

## Variants seen
- Intentional overflow in cumulative price addition now reverts under 0.8, bricking the oracle [E3](https://bugbountylibrary.com/r/c4%3A2022-04-phuture%3AH-02.md)
- Sentinel max price plus nonzero low overflows uint192 in mid-price calc, blocking redemptions [E1](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-08.md)
- Unbounded cumulative weight makes the average inertial, deadlocking the update path [E2](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-12.md)

## Why fixes fail
Fixing only the producer (returning a sentinel) leaves consumers that overflow on it [E1](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-08.md). Vendoring a library without auditing its overflow assumptions reintroduces the revert [E3](https://bugbountylibrary.com/r/c4%3A2022-04-phuture%3AH-02.md).

## Impact and severity
In the evidence this blocked core user actions: all RToken redemptions [E1](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-08.md), permanent oracle deadlock [E2](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-12.md), and a bricked oracle with dependent system [E3](https://bugbountylibrary.com/r/c4%3A2022-04-phuture%3AH-02.md). Severity is high because the failure is a hard revert on a shared path, and it is triggered by ordinary conditions (oracle timeout, market move) rather than exotic input.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-08.md
- E2: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-12.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-04-phuture%3AH-02.md