# The settle feature will be broken if attacker arbitrarily transfer collateral tokens to the PerpetualAtlanticVaultLP

Anyone can send 1 wei of WETH to PerpetualAtlanticVaultLP, breaking the strict balance equality check in subtractLoss and permanently bricking RdpxV2Core.settle.

- Payout: Contest reward
- Severity: high
- Program: Dopex
- Credited: klau5
- Disclosed: 2023-12-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/1227
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-03
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** PerpetualAtlanticVaultLP / RdpxV2Core settle flow
**Root cause:** subtractLoss requires collateral.balanceOf(address(this)) == _totalCollateral - loss; any unsolicited token transfer desyncs the actual balance from the tracked _totalCollateral, and no sync function exists.
**Steps:**
1. Deploy state: deposit 1 ether into vaultLP, purchase 1 ether option, skip 86500s to expire, set rdpx price ITM.
2. Attacker (address 777) calls `weth.transfer(address(vaultLp), 1)` sending 1 wei of collateral.
3. Call `vault.settle(ids)`; subtractLoss reverts with 'Not enough collateral was sent out' because balance != _totalCollateral - loss.
4. Settle is permanently broken; no admin function can resync _totalCollateral without moving tokens.
**How found:** Code reading of subtractLoss's strict equality check against collateral.balanceOf versus the tracked _totalCollateral, noticing unsolicited transfers desync the two.
**Exploitation:** Attacker spends 1 wei of WETH to permanently DoS the settle path of the perp vault, blocking option settlement and protocol operation.
**Insight:** Strict equality between a token's balanceOf and an internally tracked accounting variable is a griefing vector: any external transfer (donation, dust) breaks it. Look for `==` comparisons between balanceOf and internal counters in vault/LP contracts.