# USDC deposited to PerpDepository.sol are irretrievable and effectively causes UDX to become undercollateralized

PerpDepository rebalances negative PnL into USDC that can never be withdrawn, permanently locking collateral and making UDX undercollateralized.

- Payout: Contest reward
- Severity: high
- Program: Uxd
- Credited: 0x52
- Disclosed: 2022-12-27
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-uxd-judging/issues/250
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AH-4
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PerpDepository.sol insurance fund / USDC vault
**Root cause:** Negative PnL rebalancing deposits USDC into the insurance fund, but withdrawInsurance decrements insuranceDeposited and cannot redeem USDC beyond what was originally deposited, and positive PnL rebalancing was deactivated, leaving no path to withdraw the USDC.
**Steps:**
1. Call `_processQuoteMint` / `_rebalanceNegativePnlWithSwap` / `_rebalanceNegativePnlLite` to deposit USDC into the insurance fund.
2. Observe `insuranceDeposited` increments but no function redeems USDC back out.
3. Attempt `withdrawInsurance(amount, to)` as owner: it only decrements `insuranceDeposited` and transfers from vault, capped by the counter, so accumulated USDC remains locked.
**How found:** Code review of the rebalancing paths and withdrawInsurance: noticed USDC inflows had no matching outflow path after positive PnL rebalancing was deactivated, and the insuranceDeposited counter caps withdrawals.
**Insight:** When auditing collateral accounting, enumerate every inflow path and confirm a matching outflow path exists; a deactivated redemption function plus a counter-capped withdraw leaves funds permanently stranded.