# rounding errors become exploitable when amplifiable through repetition or value scale Small rounding errors in individual operations are unavoidable in integer arithmetic, but they become exploitable when amplifiable. Four amplification vectors exist: 1. **Repetition at predetermined moments**: interest accrual, reward distribution, and rebase operations execute on predictable schedules. An attacker who times calls to coincide with maximum truncation (e.g., accruing interest just before a rounding boundary) accumulates the error across many invocations. The per-call loss is negligible; the cumulative loss is not. 2. **Value scale differences**: when a function processes values across orders of magnitude, the rounding error as a fraction of the input varies. Small inputs may lose 100% to truncation (division yields zero), while large inputs lose a negligible fraction. An attacker exploiting this calls repeatedly with the minimum value that triggers the maximum fractional loss. 3. **Loop accumulation**: rounding inside loops compounds per-iteration. A loop processing N items with per-item truncation accumulates up to N units of error. Since [[DoS via block gas limit permanently bricks functions that iterate over unbounded arrays]], long loops already create risk; rounding accumulation adds an economic extraction dimension to the same pattern. 4. **Compositional direction mismatch**: when multiple operations each round in independently safe directions, the net effect across an operation sequence can produce systematic directional drift. The error is not in any single rounding decision but in their interaction. Since [[individually safe rounding directions can produce exploitable composite errors when applied across multiple operations in sequence]], the Bunni exploit ($8.4M, 2025) demonstrated this: rounding down the subtracted idle balance was conservative per-withdrawal, but across 44 withdrawals the idle balance inflated while active balance shrank disproportionately. The heuristic: for every rounding operation, check whether the error remains bounded or grows with repetition, timing, scale, or directional interaction across operations. Bounded errors are cosmetic; unbounded errors are exploitable. Since [[precision loss in DeFi can be weaponized to drain funds rather than merely disadvantaging users]] provides the severity framework (controllable inputs + attacker-accruing loss + repeatability = critical), this note provides the amplification vector taxonomy that determines whether a given rounding error reaches that severity threshold. --- Relevant Notes: - [[precision loss in DeFi can be weaponized to drain funds rather than merely disadvantaging users]] — the severity escalation framework; this note provides the amplification taxonomy that feeds into it - [[multiplication before division is required in Solidity to minimize precision loss because integer division truncates remainders permanently]] — the foundational arithmetic rule whose violation enables amplifiable rounding - [[calling a function X times with value Y should equal calling it once with value XY as a fuzzing invariant]] — a fuzzing technique that detects amplifiable rounding by comparing split vs. aggregate calls - [[modular protocol architectures hide precision loss by separating calculations across functions contracts and libraries that obscure rounding accumulation]] — architectural hiding of accumulation across module boundaries - [[individually safe rounding directions can produce exploitable composite errors when applied across multiple operations in sequence]] — the fourth amplification vector: compositional direction mismatch across operations - [[the Bunni exploit demonstrated that individually safe rounding directions become unsafe under multi-operation composition]] — the $8.4M production exploit demonstrating compositional direction mismatch Topics: - [[vulnerability-patterns]]