# Incorrect calculation of usedFunds in LiquidityPool leads to lower than expected token price

LiquidityPool trade functions fail to deduct hedgingFees from usedFunds, inflating usedFunds and depressing LP token price, shortchanging liquidity providers.

- Payout: Contest reward
- Severity: high
- Program: Polynomial Protocol
- Credited: peakbolt
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/152
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LiquidityPool.sol trade functions (openLong/closeLong/openShort/closeShort)
**Root cause:** _hedge() adds marginRequired including hedgingFees to usedFunds, but the trade functions only subtract tradeCost, never offsetting the hedgingFees that the trader already paid.
**Steps:**
1. Call openLong(amount) which transfers tradeCost+fees from user including hedgingFees
2. Observe _hedge() adds marginRequired = margin + hedgingFees to usedFunds
3. Note usedFunds only decremented by tradeCost, not hedgingFees
4. Run PoC testLiquidityPoolFundCalculation asserting pool.usedFunds() > expectedUsedFunds and availableFunds < expected by hedgingFees
5. Confirm getTokenPrice() lower than expected
**How found:** Code reading of _hedge() accounting versus trade function accounting: noticed hedgingFees added to usedFunds in _hedge but never subtracted in openLong/closeLong/openShort/closeShort, then verified with a PoC comparing expected vs actual usedFunds and token price.
**Exploitation:** Repeated trades accumulate un-offset hedgingFees in usedFunds, reducing availableFunds and lowering LP token price; LPs lose value proportional to hedging fees on every trade.
**Insight:** When a helper (_hedge) mutates shared accounting state (usedFunds) that callers also mutate, audit each caller for symmetric reversal of every component the helper added—here the fee portion was silently left in.