# Zero divisor and capacity reverts

Can a divisor, share count, or slice capacity reach zero on a reachable path?

_Area: Smart contract access control and control flow. Seen in 14 disclosed reports; latest 2026-02-18. Updated 2026-10-23._

## How it works
A value used as a divisor, denominator, or slice capacity can legitimately reach zero, and the code does not guard it. The broken assumption is "this quantity is always positive." It can hit zero through a config flag that skips normalization, a truncation that collapses a small quotient, an inverted ratio at its boundary, or a lifecycle guard that ends a program in one state but not another. The revert then blocks every caller, not just the one that produced the zero. This entry covers zero-value reverts specifically; underflow and overflow are separate root causes and are not counted here.

## Where it shows up
- A divisor derived from a ratio, scaling factor, or inverted quantity (e.g. `calFs`, `calDuration`) [E2](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.11.md)[E8](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.11.md)
- Truncation to a block size: `trunc_32(x)` is zero for `x < 32`, feeding `chunks_exact(0)` or a zero-capacity loop [E6](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-03.md)
- A config flag that skips a swap/normalization step, leaving a downstream token invariant unmet [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-3.md)
- A zero-shares or zero-supply guard that reverts when the pool is empty [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-3.md)[E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-07.md)
- A redeposit into an external strategy that mints zero shares or hits a deposit cap [E4](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AM-01.md)

## How to review
For every division, modulo, slice, and share computation, trace whether the denominator can reach zero through any reachable path: config, owner action, full withdrawal, full burn, post-unlock state, or truncation. The invariant: every divisor is provably nonzero on all reachable states, or the code handles zero explicitly.
- Check both branches of a factor computation, not just the guarded one [E2](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.11.md).
- Check the sub-block-size boundary: `trunc_32(x)` is zero for `x < 32` [E6](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-03.md).
- Check the inverted-ratio boundary after a full burn or withdrawal [E8](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.11.md).
- Check that lifecycle guards cover pre- and post-unlock states [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-07.md).
- Check external strategy/vault inputs against their own minimum-share and cap bounds [E4](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AM-01.md).
- Distinguish from underflow/overflow: here the value is a valid zero, not a wrapped one.

## Variants seen
- Config flag bypasses normalization; zero-staker guard reverts on the unswapped token [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-3.md)
- Owner withdrawal zeroes factor, divisor becomes zero [E2](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.11.md)
- Truncated threshold collapses to zero, panic or livelock [E6](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-03.md)
- Post-unlock zero shares while rewards active [E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-07.md)
- External strategy mints zero shares, redeposit reverts [E4](https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AM-01.md)
- Inverted ratio returns zero after full burn [E8](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.11.md)

## Impact and severity
Permanent DoS of core functions: bond/debond/stake, withdrawals, swaps, prover [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-3.md)[E2](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.11.md)[E3](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-07.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-03.md). Funds can be trapped [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-3.md)[E2](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.11.md)[E8](https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.11.md). Severity is high when the zero state is reachable by a normal user or owner action and no recovery path exists; worse when it locks user funds rather than only pausing a keeper.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-3.md
- E2: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.1.11.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-07.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AM-01.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-10-nextgen%3AH-04.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-09-succinct%3AM-03.md
- E7: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.13.md
- E8: https://bugbountylibrary.com/r/cantina%3Agoat_mar2024%3A3.2.11.md