# Collateral freed at live price not stored basis

Lock and unlock of collateral computed from different-time inputs; refunds ignoring prior withdrawals

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-07-15. Updated 2026-10-25._

## How it works

Collateral is locked using one set of inputs and released using another. The lock happens at action time (deposit, open, add debt); the release recomputes the same formula later from live price, exchange rate, or collateralization ratio. If any input moved in between, freed collateral no longer equals locked collateral. The broken assumption is that "the formula is deterministic, so recomputing gives the same number." It only holds if every input is frozen between lock and release. A second shape: a refund is computed from position size without checking whether that same margin slice was already withdrawn [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md).

## Where it shows up

- Lock and unlock both call the same live conversion (price, ratio, exchange rate) instead of reading a stored checkpoint [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.6.md).
- Close/withdraw paths refund `notional/leverage` or similar without tracking prior withdrawals [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md).
- Health or minimum checks that scale with a dimension (debt, short size) that can reach zero, making the check vacuous [E2](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-17.md).
- Migration or setter functions validating solvency at spot rate while later claims re-read that rate [E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.9.md).
- Any `require` comparing a live-derived amount to a stored amount.

## How to review

For every lock, find the matching release and list each input to both formulas. The invariant: **the amount freed must equal the amount locked for that position, regardless of price, ratio, or rate changes between the two events.** Check that release reads a stored basis, not a recomputation. For refunds, confirm the refunded slice was not already paid out [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md). For close flows, check the boundary where one dimension hits zero: does the remaining dimension still get validated? [E2](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-17.md) For setters, confirm downstream claims use the same rate the setter validated against, and that the old component keeps authorization [E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.9.md).

## Variants seen

- Lock/free formula recomputed at live price and ratio, so full repayment cannot withdraw full deposit [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.6.md).
- Margin refunded on close after the same initial margin was already withdrawn [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md).
- Vacuous minimum check when short/debt amount is zero, stranding residual collateral [E2](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-17.md).
- Solvency check at spot rate in a migration setter, diverging from later claim rate [E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.9.md).

## Impact and severity

Funds drained [E1](https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md), collateral permanently locked [E2](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-17.md)[E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.9.md), users unable to recover full deposits [E3](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.6.md). Severity rises when the divergence is unbounded (price/ratio drift) or when the stranded amount is the user's entire position.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-14.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-17.md
- E3: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.6.md
- E4: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.9.md