# usedFunds can be greater than totalFunds in contract KangarooVault, which leads to KangarooVault being unable to close its trades and users being unable to withdraw

KangarooVault lacks a totalFunds>=usedFunds invariant check, so a direct SUSD transfer lets usedFunds exceed totalFunds, underflowing _resetTrade and processWithdrawalQueue and blocking trade closure and withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Polynomial Protocol
- Credited: KIntern\_NA
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/203
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-07
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** KangarooVault Solidity contract (vault accounting)
**Root cause:** usedFunds is incremented on margin transfers out and totalFunds decremented on transfers in without enforcing totalFunds >= usedFunds; direct token transfers into the vault are not reflected in totalFunds, so usedFunds can exceed totalFunds.
**Steps:**
1. Deposit 1000 SUSD via normal path: totalFunds=1000, usedFunds=0.
2. Attacker transfers 1000 SUSD directly to the KangarooVault contract (not counted in totalFunds).
3. Vault opens a short position using 2000 SUSD margin, incrementing usedFunds to 2000.
4. Now usedFunds(2000) > totalFunds(1000).
5. Call close-trade path: `_resetTrade` executes `totalFunds -= usedFunds` and reverts on underflow.
6. Call `processWithdrawalQueue`: `availableFunds = totalFunds - usedFunds` reverts on underflow, blocking withdrawals.
**How found:** Code review of KangarooVault accounting: noticed usedFunds/totalFunds are only updated on internal transfers, not on direct token transfers, and that no invariant check exists before subtraction in _resetTrade and processWithdrawalQueue.
**Exploitation:** Any user can donate SUSD directly to the vault to inflate the gap between actual balance and totalFunds; once the vault opens a position sized against the real balance, usedFunds exceeds totalFunds, permanently reverting trade closure and withdrawal processing, locking user funds.
**Insight:** In vault accounting, compare tracked totalFunds against actual token balance; any path where the contract can spend its real balance (including donated tokens) without syncing the tracked counter can break subtraction invariants and brick withdrawals.