# Function hedgePositions is incorrect, because it missed the queuedPerpSize in the calculation

hedgePositions omits queuedPerpSize when computing current position, so repeated hedging double-counts and pushes the pool's Synthetix perp position to a wrong size, risking funds loss.

- Payout: Contest reward
- Severity: high
- Program: Polynomial Protocol
- Credited: KIntern\_NA
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/113
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** LiquidityPool.hedgePositions / Synthetix perp hedging
**Root cause:** _getTotalPerpPosition sums on-chain position size and delayed order sizeDelta but omits queuedPerpSize (pending size deltas not yet submitted), so newPosition is computed against an understated current position.
**Steps:**
1. Start with _getTotalPerpPosition()=0, requiredPosition=1000, queuedPerpSize=1000.
2. hedgePositions computes newPosition = requiredPosition - currentPosition = 1000, ignoring queuedPerpSize.
3. It calls _placeDelayedOrder(1000,false), raising queuedPerpSize to 2000.
4. After delayed orders execute, pool perp position = 2000 instead of the correct -1000, mis-hedging the pool.
**How found:** Code review of hedgePositions and _getTotalPerpPosition, noticing the position sum only includes executed position and delayed order sizeDelta but not the queuedPerpSize accumulator used by _placeDelayedOrder.
**Exploitation:** Repeated or overlapping hedgePositions calls accumulate queued size deltas that are never accounted for, driving the pool's actual Synthetix perp position far from the intended hedge; an attacker can exploit the resulting unhedged exposure to cause LiquidityPool fund loss.
**Insight:** When a contract tracks pending state in a separate accumulator (queuedPerpSize) from what the external protocol reports (delayedOrders), any 'current position' helper must include both; audit every read of external position state against internal pending counters.