# Attacker can transfer all SUSD’s balance of LiquidityPool as margin to Synthetix perpetual market, and break the actions of users until the pool is rebalanced by the authority

LiquidityPool always transfers positive margin per trade, so repeated open/close in one tx drains all SUSD margin, blocking user actions until rebalanced.

- Payout: Contest reward
- Severity: medium
- Program: Polynomial Protocol
- Credited: KIntern\_NA
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/112
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-13
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** LiquidityPool._hedge / Synthetix perp margin transfer
**Root cause:** _hedge computes marginRequired from the independent hedgingSize and always transfers it as positive margin, even when the pool's net perpetual size is unchanged or decreasing, instead of netting against existing margin like rebalanceMargin.
**Steps:**
1. Attacker calls open position then close position within a single transaction, repeating the loop.
2. Each _hedge call computes marginRequired = _calculateMargin(hedgingSize) + hedgingFees, always > 0.
3. perpMarket.transferMargin(int256(marginRequired)) moves SUSD from LiquidityPool to Synthetix perp market each iteration.
4. Loop until pool's SUSD balance is exhausted; net perpetual size returns to original.
5. Users' withdraw, open-short, close-long actions revert for lack of SUSD until authority calls rebalanceMargin().
**How found:** Code reading of _hedge revealed marginRequired is always positive and transferred unconditionally regardless of whether the pool's perpetual size increased or decreased; compared to rebalanceMargin's netting logic.
**Exploitation:** Repeated open/close of a position in one transaction forces the pool to transfer margin to Synthetix perp market on every trade despite no net size change, draining the pool's SUSD and DoS-ing user actions until a keeper rebalances.
**Insight:** When a contract transfers margin/fees per trade, check whether the amount is computed from the delta or from the absolute position size; absolute-size margin transfers can be farmed by round-tripping trades in one tx to drain collateral.