# Wrong shortfall calculation

In Perennial's OptimisticLedger.settleAccount, shortfall is added twice, doubling it and inflating totals, blocking users from withdrawing correct funds.

- Payout: Audit contest
- Severity: high
- Program: Perennial
- Found by: kenzo
- Disclosed: 2022-01-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-perennial-findings/issues/18
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-perennial%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** OptimisticLedger.settleAccount collateral accounting (Solidity)
**Root cause:** settleAccount assigns shortfall = self.shortfall + newBalance.abs() inside the if, then unconditionally does self.shortfall = self.shortfall.add(shortfall), adding the new shortfall twice.
**Steps:**
1. Read settleAccount in OptimisticLedger.sol: on negative newBalance, shortfall = self.shortfall.add(newBalance.abs())
2. Note the unconditional self.shortfall = self.shortfall.add(shortfall) at the end double-counts
3. Add `await collateral.connect(productSigner).settleAccount(userB.address, -50)` to the 'shortfall reverts if depleted' test at Collateral.test.js:190
4. Observe shortfall reports 150 instead of expected 100
**How found:** Code review of settleAccount accounting logic; noticed shortfall already includes self.shortfall before being added again, then confirmed via a modified unit test.
**Insight:** When a helper returns a value that already incorporates prior state, check whether the caller re-adds it to that same state—double-counting bugs hide in 'return value + accumulator' patterns.