# Unchecked arithmetic halts control flow

Division, subtraction or Quo on attacker-influenced weights or totals without zero, bound or underflow guards

_Area: Smart contract access control and control flow. Seen in 4 disclosed reports; one confirmed bounty: $15,000; latest 2025-08-04. Updated 2026-10-23._

## How it works
A control-flow path (tally, weight update, vote scoring) performs arithmetic on values an attacker or governance can influence, and assumes the result is valid. The assumption breaks: a divisor can be zero or extreme, a subtraction can go below zero, or a math library call can return an error the caller ignores. The operation reverts or errors, and because it sits on a shared path (block end, every gauge call, every vote), the whole flow halts rather than failing one user's action.

## Where it shows up
- Division or `Quo`/`Div` on totals, weights or percentages derived from user-supplied or governance-supplied inputs [E1](https://bugbountylibrary.com/r/h1%3A3018307.md).
- Decimal math libraries whose calls have multiple error returns (exponent range, overflow, underflow) where only one is handled [E1](https://bugbountylibrary.com/r/h1%3A3018307.md).
- Setters that update one accumulator (bias) but not its paired rate (slope), leaving them inconsistent [E2](https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-05.md).
- Subtraction of a delta from a value assumed to be large enough, e.g. `x + a - 1000` assuming `a >= 1000` [E3](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-21.md).
- Arithmetic inside loops over attacker-controlled arrays (battle lists, member lists) on a shared tally path [E1](https://bugbountylibrary.com/r/h1%3A3018307.md)[E3](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-21.md).

## How to review
For every division, subtraction and library math call on a shared path, identify the input bounds. The invariant: divisors are provably non-zero and within the library's supported exponent/range, and every subtraction has a checked lower bound. Confirm the caller handles all error returns of the math call, not just one. For paired accumulators, confirm any setter updates both consistently so later deltas cannot underflow [E2](https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-05.md). For scoring formulas, confirm negative deltas are representable or clamped before subtraction [E3](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-21.md).

## Variants seen
- Extreme decimal weights (1e-50000 vs 1e50000) make `Quo` error in EndBlocker, halting the chain [E1](https://bugbountylibrary.com/r/h1%3A3018307.md).
- Lower-then-raise of a gauge weight zeroes slope while bias stays positive; later subtraction underflows, bricking all gauge functions [E2](https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-05.md).
- Rating formula underflows when losses push a term below its assumed floor, reverting valid votes [E3](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-21.md).

## Impact and severity
Chain halt [E1](https://bugbountylibrary.com/r/h1%3A3018307.md), permanent denial of service on all functions for a gauge with votes locked [E2](https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-05.md), and governance DoS [E3](https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-21.md). Severity is high because the failure is on a shared path and persists until state is corrected; attacker-influenced inputs and unhandled library errors make it worse.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A3018307.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-05.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-04-virtuals-protocol%3AM-21.md