# Accumulator overflow reverts under checked math

Attacker-inflated or intentionally wrapping accumulators that revert under Solidity 0.8 checked math, causing DoS

_Area: Smart contract access control and control flow. Seen in 2 disclosed reports; latest 2026-02-05. Updated 2026-10-23._

## How it works
Accumulator math (reward-per-share, price oracles, allowances) is designed to grow large or wrap around. Under Solidity 0.8 checked arithmetic, an addition or multiplication that exceeds uint256.max reverts instead of wrapping. If an attacker can push the accumulator toward that ceiling, every later operation that reads or updates it reverts, permanently blocking the function for all users.

## Where it shows up
- Reward accounting that divides a scaled numerator by a supply the caller can influence (deposit, mint, bribe) [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-7.md).
- `deposit * accDebtPerShare` style multiplications where the accumulator is attacker-inflatable [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-7.md).
- `safeIncreaseAllowance`/`approve` on tokens whose `allowance()` returns `uint256.max` for a spender [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AM-12.md).
- Uniswap V2 forks with `price0CumulativeLast`/`price1CumulativeLast` additions not wrapped in `unchecked` [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-20.md).
- Pragma bumped to >=0.8 on code originally relying on wraparound [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-20.md).

## How to review
Identify every accumulator and confirm the invariant: either it can never approach uint256.max given realistic inputs, or its overflow is intentional and wrapped in `unchecked`. For reward shares, check whether an untrusted party controls the token supply or deposit used in the division/multiplication [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-7.md). For integrations, check the token's `allowance()` override before calling increase/approve [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AM-12.md). For forks, diff the pragma and confirm wraparound-dependent math is `unchecked` [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-20.md).

## Variants seen
- Attacker mints max-supply token, bribes pool with 1 wei deposit, poisons `accDebtPerShare`, blocking votes and stealing yield [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-7.md).
- Infinite-allowance token makes `safeIncreaseAllowance` overflow, DoSing withdrawals [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AM-12.md).
- Checked price accumulators revert `_update`, DoSing swaps, liquidity and TWAP AMM-wide [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-20.md).

## Impact and severity
Permanent denial of service on core functions (voting, withdrawals, swaps) plus yield theft in E1. Severity is high because the block is persistent and affects all users, not just the attacker. Worse when the poisoned accumulator is shared state that cannot be reset without an upgrade.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-06-magicsea%3AH-7.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AM-12.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-20.md