# Incorrect parameter ordering in function call

Swapped borrowingFactor and sizeInUsd args in updateTotalBorrowing call corrupts GMX total borrowing accounting, risking user fund loss.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: float-audits
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/97
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-18
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** Solidity smart contract (PositionUtils/MarketUtils)
**Root cause:** PositionUtils.updateTotalBorrowing passes params.position.borrowingFactor() and params.position.sizeInUsd() in the wrong order relative to MarketUtils.updateTotalBorrowing's signature (prevPositionSizeInUsd, prevPositionBorrowingFactor).
**Steps:**
1. Read MarketUtils.updateTotalBorrowing signature: (dataStore, market, isLong, prevPositionSizeInUsd, prevPositionBorrowingFactor, nextPositionSizeInUsd, nextPositionBorrowingFactor)
2. Compare to call site in PositionUtils.updateTotalBorrowing which passes borrowingFactor() then sizeInUsd()
3. Observe the two args are swapped, feeding wrong prev values into getNextTotalBorrowing
4. Result: setTotalBorrowing stores corrupted totalBorrowing for the market/side
**How found:** Manual code review comparing the call site argument order against the callee function signature in a different file.
**Insight:** When auditing cross-contract internal calls, diff the argument order at each call site against the callee signature — same-typed uint256 params (size vs factor) silently swap without compiler error.