# Hedging during liquidation is incorrect

Liquidation in Exchange burns power perp and reduces short size equally, but LiquidityPool still hedges the repaid amount, over-hedging and losing funds.

- Payout: Contest reward
- Severity: high
- Program: Polynomial Protocol
- Credited: KIntern\_NA
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/214
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Exchange._liquidate / LiquidityPool.liquidate hedging logic
**Root cause:** Liquidation reduces short position and burns power perp by the same amount (skew unchanged), yet LiquidityPool.liquidate still calls _hedge for the repaid amount, hedging more than needed.
**Steps:**
1. Trigger liquidation of a short position via Exchange._liquidate(positionId, debtRepaying).
2. Observe shortToken.adjustPosition reduces shortAmount by debtRepaying and powerPerp.burn(msg.sender, debtRepaying) burns equal tokens, leaving skew unchanged.
3. Note pool.liquidate(debtRepaying) still calls _hedge(int256(amount), true), adding an unnecessary hedge of debtRepaying.
4. Result: LiquidityPool position in Perp Market is over-hedged, diverging from intended hedge and losing funds.
**How found:** Code reading of _liquidate: noticed shortAmount reduction and powerPerp burn are equal (skew unchanged) but pool.liquidate still hedges the same amount, implying double-counted hedge.
**Exploitation:** Liquidation events cause LiquidityPool to hedge an amount that no longer matches its skew, accumulating incorrect perp positions and unexpected fund loss over repeated liquidations.
**Insight:** When a position is closed by burning the offsetting token, skew is unchanged; check whether downstream hedging/rebalancing logic still reacts to the nominal amount and over-corrects.