# Incorrect balance computed in getUsersConfirmedButNotSettledSynthBalance()

getUsersConfirmedButNotSettledSynthBalance uses the current market update index price instead of the user's queued update index, misreporting pending shift balances.

- Payout: Audit contest
- Severity: medium
- Program: Float Capital
- Found by: hack3r-0m and cmichel
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-08-floatcapital-findings/issues/142
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-floatcapital%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error

**Target:** LongShort.sol view function getUsersConfirmedButNotSettledSynthBalance
**Root cause:** The view reads syntheticToken_priceSnapshot at currentMarketUpdateIndex rather than the user's userNextPrice_currentUpdateIndex, so a queued shift is valued at a later oracle update's price.
**Steps:**
1. Set long_synth_balance=300, short_synth_balance=200, marketUpdateIndex[1]=x, userNextPrice_currentUpdateIndex=0.
2. User calls `shiftPositionFromLongNextPrice(1, 100)`; balances become 200/200, userNextPrice_syntheticToken_toShiftAwayFrom_marketSide[1][true]=100, userNextPrice_currentUpdateIndex=x+1.
3. Oracle updates twice so marketUpdateIndex[1]=x+2.
4. Call `getUsersConfirmedButNotSettledSynthBalance(user, 1)`; the guard passes and it reads `syntheticToken_priceSnapshot[1][isLong][x+2]` instead of the x+1 snapshot.
**How found:** Code reading of the view function's index selection: noticed it uses currentMarketUpdateIndex while the user's pending settlement is keyed to userNextPrice_currentUpdateIndex, then constructed a state where the two diverge after multiple oracle updates.
**Insight:** In queued/next-price settlement designs, check that every view and accounting path reads the snapshot at the user's stored update index, not the global current index; divergence appears only after the oracle advances past the user's queued index.