# Put settlement can be anticipated and lead to user losses and bonding DoS

Dopex LP depositors can anticipate put settlement and redeem before losses, forcing remaining LPs to absorb more loss and draining collateral to DoS bonding.

- Payout: Contest reward
- Severity: high
- Program: Dopex
- Credited: LokiThe5th
- Disclosed: 2023-12-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/1584
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-02
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:oracle-manipulation

**Target:** PerpetualAtlanticVaultLP / PerpetualAtlanticVault put options vault
**Root cause:** Settlement price threshold is publicly known and PerpetualAtlanticVaultLP permits redemption at any time while excess collateral exists, so LPs can exit before in-the-money puts are settled.
**Steps:**
1. Deposit WETH into PerpetualAtlanticVaultLP alongside other LPs
2. Core purchases puts; monitor rdpxPriceInEth approaching strike
3. When puts go in the money, call `vaultLp.redeem(balance, user, user)` before `vault.settle(tokenIds)`
4. After settle, re-deposit WETH to capture more shares at depressed value
5. Remaining LPs absorb the settlement loss; if all collateral is withdrawn, `vault.purchase` reverts, DoSing bonding
**How found:** Observed that settlement trigger price is deterministic and LP redemption is unrestricted, hypothesizing LPs would rationally exit before known loss events; validated with Foundry PoC comparing anticipating vs non-anticipating LP PnL.
**Exploitation:** LP monitors price or mempool for `PerpetualAtlanticVault::settle()`, redeems shares pre-settlement to avoid taking on rdpx at above-market prices, then re-enters post-settlement; slower LPs bear the loss and drained collateral blocks new bond purchases.
**Escalation:** Economic incentive causes race of redemptions draining totalAvailableCollateral, temporarily DoSing RdpxV2Core bonding and threatening DpxEth peg.
**Insight:** In vault/option designs, check whether loss events have publicly predictable triggers combined with unrestricted share redemption; that combination lets informed LPs socialize losses onto passive LPs and can drain collateral needed by other protocol functions.