# ClampLib::mulDivDownInverse contains a dead `n == 0` check Low/Info · Blackthorn · Fixed-rate lending · 22nd May, 2026 Finding L-4 of the Tenor Morpho Migrations security review. - Protocol: https://www.tenor.finance/ - Report: /reports/tenor-markets - Source: https://github.com/tenor-labs/tenor-contracts/blob/main/audits/2026-06-Blackthorn-review.pdf --- ## Summary The `n == 0` branch in `mulDivDownInverse` is unreachable: `n` is assigned `target + 1`, so it is always `>= 1` in any path that reaches the check (the only way `n` could be `0` is the overflow case `target == type(uint256).max`, which already reverts on the line above under Solidity 0.8.x checked arithmetic). ## Vulnerability Detail [Code](https://github.com/sherlock-audit/2026-05-tenor-markets-may-21st-2026/blob/main/tenor-morpho-v2-contracts-2/src/periphery/libraries/ClampLib.sol#L232-L237): ```solidity uint256 n = target + 1; if (n == 0 || den > type(uint256).max / n) { return type(uint256).max; } ``` `n == 0` looks like an intentional overflow guard, but with checked arithmetic the addition reverts before `n` becomes `0`. The check is misleading and obscures the real overflow case (see the sibling finding on `target + 1` overflowing). ## Impact Confusing code. ## Code Snippet https://github.com/sherlock-audit/2026-05-tenor-markets-may-21st-2026/blob/main/tenor-morpho-v2-contracts-2/src/periphery/libraries/ClampLib.sol#L234 ## Tool Used Manual Review ## Recommendation ```solidity if (target == type(uint256).max) return type(uint256).max; uint256 n = target + 1; if (den > type(uint256).max / n) return type(uint256).max; ``` --- Related findings: - [mul() and div() in NFTPMath are misleading due to scaling by 1e18 underneath](https://0xsimao.com/findings/nftperp-i-nftp-scaling-1e18-underneath): Nftperp Exchange - [`LenderCommitmentGroup_Smart` does not use `mulDiv` when converting between token and share amounts, possibly leading to DoS or loss of funds](https://0xsimao.com/findings/teller-finance-mul-div-converting-share): Teller Finance