# Collateral cannot be claimed because there is no mechanism for the config keeper to change the claimable factor

GMX Synthetics claimCollateral applies a claimable factor that config keeper cannot set, defaulting to zero, so users can never reclaim collateral from capped price impacts.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/137
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Solidity smart contract (MarketUtils.claimCollateral / Config)
**Root cause:** claimCollateral multiplies claimableAmount by claimableCollateralFactor read from DataStore, but CLAIMABLE_COLLATERAL_FACTOR is not in Config's allowedBaseKeys, so the config keeper can never set it and it stays at the default zero.
**Steps:**
1. Read MarketUtils.claimCollateral: `adjustedClaimableAmount = Precision.applyFactor(claimableAmount, claimableFactor)` where claimableFactor = dataStore.getUint(Keys.claimableCollateralFactorKey(...))
2. Check Config.sol allowedBaseKeys: CLAIMABLE_COLLATERAL_FACTOR is absent, so setUint for that key reverts for the config keeper
3. Observe factor remains 0, making adjustedClaimableAmount 0 for all users
4. Call claimCollateral as a user with recorded claimable collateral; claim is blocked/zeroed
**How found:** Code review of the claim path traced the claimableFactor read to DataStore and cross-checked Config's allowedBaseKeys whitelist, noticing the key was never registered so the keeper cannot set it.
**Insight:** When a value is read from a DataStore/registry and multiplied into a payout, verify the corresponding key is whitelisted in the config setter; an unsettable key silently defaults to zero and bricks the feature.