# Setting maxFundingFeePerBlock to a lower value than abs(lastFundingRate) will brick getPendingAccFundingFees() Medium · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-M12 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description [getPendingAccFundingFees()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumPairInfos.sol#L421) computes the number of blocks to the limit by subtracting absLastFundingRate to maxFundingFeePerBlock. [setMaxFundingFeePerBlock()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumPairInfos.sol#L306) allows setting the max to any value below [MAX_FUNDING_FEE](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumPairInfos.sol#L27). If maxFundingFeePerBlock is set to a value smaller than absLastFundingRate it will underflow, bricking getPendingAccFundingFees() and it can only be fixed by calling [setPairFundingFees()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumPairInfos.sol#L171). [Here](https://github.com/0xOstium/smart-contracts-threeSigma/blob/poc-maxFundingFeeRate-increase-more-than-current/test/foundry/OstiumPairInfos.t.sol#L1284) is a POC. ### Recommendation Revert if setMaxFundingFeePerBlock() is called with maxFundingFeePerBlock smaller than absLastFundingRate. ### Status Addressed in [#6b6d191](https://github.com/0xOstium/smart-contracts-threeSigma/pull/58/commits/6b6d191cfb8658d175a34dbce7d80b24bd2a9222), [#829ad27](https://github.com/0xOstium/smart-contracts-threeSigma/pull/58/commits/829ad2749c6daea6623db6d44d5a4dc0a9706ec1). --- Related findings: - [`rewardData.releaseRate` is incorrectly calculated on `RewardsController::config()` when `block.timestamp > start` and `rewardData.lastConfig != rewardData.start`](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-reward-release-rewards-timestamp): Exactly Protocol Update - Staking Contract - [When APR late rate is lower than APR, an OCC locker bullet loan borrower can pay way less interests by calling the loan](https://0xsimao.com/findings/zivoe-occ-bullet-pay-interests): Zivoe - [Anyone can frontrun a relayer interaction with the same arguments but a much higher/lower relayer fee](https://0xsimao.com/findings/singularity-frontrun-relayer-interaction-fee): Singularity - [Malicious user can call `borrowing::calculateCumulativeRate()` any number of times to inflate debt rate as `lastEventTime` is not updated](https://0xsimao.com/findings/autonomint-calculate-times-inflate-debt): Autonomint