# `rebalanceLite` should provide a slippage protection

rebalanceLite lacks minAmountOut; Perp partial fills when sqrtPriceLimitX96 set leave user's quote tokens stranded in Perp vault.

- Payout: Contest reward
- Severity: medium
- Program: Uxd
- Credited: hansfriese
- Disclosed: 2022-12-27
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-uxd-judging/issues/429
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PerpDepository.rebalanceLite / Perp ClearingHouse order
**Root cause:** rebalanceLite pulls the full `amount` from the user and deposits to Perp vault, but _placePerpOrder with sqrtPriceLimitX96 can partially fill, leaving unused quote tokens in the Perp vault with no refund or minimum-out check.
**Steps:**
1. Call `rebalanceLite(amount, -1, sqrtPriceLimitX96, account)` with a tight sqrtPriceLimitX96.
2. Contract does `transferFrom(account, this, amount)` then `vault.deposit(quoteToken, amount)`.
3. `_placePerpOrder` fills only partially because Perp ClearingHouse won't revert at the price limit.
4. Only `baseAmount` from the partial fill is withdrawn and transferred to account; remainder stays in Perp vault.
**How found:** Compared rebalance() (has amountOutMinimum) against rebalanceLite() (only sqrtPriceLimitX96); read Perp ClearingHouse comment that sqrtPriceLimitX96 fills until price but WON'T REVERT, and confirmed with Perp devs that partial fills are possible.
**Exploitation:** User-initiated rebalance with a price limit that gets partially filled; the unfilled quote token portion is deposited into Perp's vault and never returned to the caller, causing direct fund loss to the user.
**Insight:** When a downstream AMM/perp accepts a price limit instead of a min-out, treat it as partial-fill-capable: check whether the integrator refunds the unfilled input or only forwards the filled output.