# Incorrect `nextOpenInterest` values set for `priceImpact`

getNextOpenInterestParams left the untouched side's next open interest at 0, corrupting priceImpact and causing users to pay large negative impact instead of positive.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: float-audits
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/105
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PositionPricingUtils.sol price impact / open interest logic
**Root cause:** getNextOpenInterestParams only updates the next open interest for the side the action is on, leaving the other side's next value at its default 0 instead of the current open interest.
**Steps:**
1. Read getPriceImpactUsd -> getNextOpenInterest -> getNextOpenInterestParams in PositionPricingUtils.sol
2. Observe nextLongOpenInterest/nextShortOpenInterest default to 0 and only one branch assigns
3. Set isLong=true, sizeDeltaUsd=2, longOpenInterest=10, shortOpenInterest=13
4. Result: nextLongOpenInterest=12, nextShortOpenInterest=0 (should be 13)
5. nextDiffUsd becomes 12 instead of 1, flipping isSameSideRebalance to false and producing large negative priceImpact
**How found:** Code reading of the price impact call chain; noticed the default-zero next open interest for the non-action side and traced how it flips isSameSideRebalance.
**Exploitation:** A user whose trade improves market balance (e.g. opening long when long OI <= short OI) is charged a large negative price impact instead of receiving positive impact, causing loss of user funds on each such trade.
**Insight:** When a helper computes 'next' state for a pair of values, check that both sides are initialized from current state, not just the mutated one; a zero default silently distorts downstream diff/sign logic.