# Users' collateral could get stuck permanently after fully closing short trades

Closing a short with shortAmount fully but collateralAmount zero or partial burns the NFT, permanently locking remaining collateral in ShortCollateral.

- Payout: Contest reward
- Severity: medium
- Program: Polynomial Protocol
- Credited: RaymondFam
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/67
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Exchange._closeTrade / ShortCollateral / ShortToken
**Root cause:** _closeTrade only checks totalCollateralAmount >= minCollateral; when totalShortAmount==0 minCollateral is 0, so params.collateralAmount can be less than the position's collateral. ShortToken then burns the NFT because shortAmount==0, leaving residual collateral unclaimable.
**Steps:**
1. Open a short position with shortAmount S and collateralAmount C.
2. Call closeTrade with params.amount=S (full short) but params.collateralAmount=0 or <C.
3. Observe require(totalCollateralAmount >= minCollateral) passes since minCollateral=0 when totalShortAmount=0.
4. sendCollateral transfers only params.collateralAmount; adjustPosition sets shortAmount=0 and burns the NFT.
5. Attempt to withdraw remaining collateral: require(shortToken.ownerOf(positionId)==msg.sender) reverts because NFT is burned.
**How found:** Code reading of _closeTrade: noticed minCollateral becomes zero when totalShortAmount is zero, so the collateral check is vacuous on full close; traced sendCollateral and ShortToken burn to confirm residual collateral becomes unrecoverable.
**Exploitation:** User accidentally supplies zero/partial collateralAmount via Etherscan; transaction succeeds, NFT burned, residual collateral permanently stuck in ShortCollateral with no recovery path.
**Insight:** In position-close flows, check invariants at the boundary where one dimension (debt/short) hits zero: any min/health check that scales with that dimension becomes vacuous, so validate the other dimension (collateral) explicitly before burning the position NFT.