# Missing totalFunds update in LiquidityPool's OpenShort(), causing LiquidityPool token holder to lose a portion of their token value

Polynomial's LiquidityPool.openShort() fails to increment totalFunds by net fees, understating availableFunds and token price, causing LP token holders to lose value.

- Payout: Contest reward
- Severity: high
- Program: Polynomial Protocol
- Credited: peakbolt
- Disclosed: 2023-08-01
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/153
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LiquidityPool.sol openShort() accounting
**Root cause:** openShort() collects net fees (feesCollected - externalFee) via tradeCost deduction but never adds them to totalFunds, so availableFunds and the LP token price are understated.
**Steps:**
1. Deploy Polynomial LiquidityPool with Synthetix perp market and SUSD.
2. Record totalFundsBefore and usedFundsBefore.
3. Call `openShort(amount, amount*1000, user_1)` with amount=1e18.
4. Compute expectedTotalFunds = totalFundsBefore + feesCollected - externalFee.
5. Observe `pool.totalFunds() < expectedTotalFunds` and `pool.usedFunds() > expectedUsedFunds`.
6. Observe `poolAvailableFunds == expectedAvailableFunds - hedgingFees` and `pool.getTokenPrice() < expectedTokenPrice`.
**How found:** Auditor traced openShort()'s fee flow: tradeCost is reduced by fees before transfer, implying the pool should retain net fees, but totalFunds was never incremented. A Foundry PoC compared totalFunds/usedFunds/availableFunds and token price against expected values.
**Exploitation:** A trader repeatedly opens shorts; each trade's net fee is deducted from the trader but not credited to totalFunds, so the LP token price stays below fair value. An attacker holding LP tokens can redeem at the depressed price after fees accumulate, or a short trader benefits from the mispriced token; LPs lose the fee value.
**Insight:** In fee-collecting pool contracts, verify every path that deducts fees from a user also credits the pool's accounting variable; compare totalFunds against actual token balance and usedFunds to spot missing increments.