# state.cumulativeDepositsMultiplierX18 may become 0 or negative, leading to loss of funds Crit/High · Three Sigma · Hybrid orderbook DEX · 3rd April 2024 Finding 3S-Vertex-H01 of the Vertex security review. - Report: /reports/vertex - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-04-03-vertex.pdf --- ### Description state.cumulativeDepositsMultiplierX18 may go below 0 if an account is [socialized](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/blob/main/contracts/SpotEngine.sol#L311-L312) or in the worst case, 0, which will have greater impact. The point of socializing a spot account is eliminating the borrowed amount from the short account and transferring it to the other depositors. The problem is that the multiplier may become 0 or negative which is never handled. If the multiplier goes to 0, every deposit will [revert](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/blob/main/contracts/SpotEngineState.sol#L128) and the user will lose its funds. If it becomes negative, every deposit will be treated as a short instead and the user may be liquidated (deposits have no health check). ### Recommendation Don't let the multiplier become 0 or lower by reverting in this case. ### Status Addressed in [#38bbe76](https://github.com/vertex-protocol/vertex-contracts-3sigma-audit/commit/38bbe768d64139b9de91a065f4bdd1cb1e212198). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [OstiumOpenPnl::average() can be simplified by adding a state variable that tracks the cumulative sum of nextEpochValues](https://0xsimao.com/findings/ostium-average-tracks-sum-epoch): Ostium - [`CDSLib::calculateCumulativeRate()` incorrectly only increment the local option fees when there are cds deposits](https://0xsimao.com/findings/autonomint-increment-local-fees-deposits): Autonomint - [Yield loss due to StrategyRouterLib:rebalanceStrategies() not allocating saturated strategy deposits](https://0xsimao.com/findings/clip-finance-i-yield-allocating-saturated-deposits): Clip Finance Strategies - [Frozen/paused Market that is harvested from in StakedEXA will DoS deposits leading to loss of yield](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-paused-harvested-deposits-yield): Exactly Protocol Update - Staking Contract