# Unpaid funding fees from wrong calculation are going to be substracted from the pool

GMX funding-fee per-size values divided by total open interest instead of collateral-specific OI, so payers paid less than claimers could claim, draining the pool.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: stopthecap
- Disclosed: 2022-09-22
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/67
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-20
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** GMX Synthetics MarketUtils.getNextFundingAmountPerSize funding fee accounting
**Root cause:** fundingAmountPerSizePortion_*Collateral_*Position divides fundingUsd by the entire long/short open interest rather than the open interest held with that specific collateral, so per-size pay values are diluted while claim values remain full.
**Steps:**
1. Deploy fixture; deposit into ethUsdMarket and ethUsdSpotOnlyMarket.
2. Set fundingFactorKey and fundingExponentFactorKey on ethUsdMarket.
3. Open four $100K-$200K positions: user0 long/long-collateral, user1 short/short-collateral, user2 short/long-collateral, user3 long/short-collateral.
4. Advance time 300 days to accrue funding fees.
5. Close all positions via MarketDecrease.
6. Compare pendingFundingFees.fundingFeeAmount paid by user0/user3 vs claimableFundingAmountKey for user1/user2; total claimable > total paid.
**How found:** Code review of getNextFundingAmountPerSize; noticed fundingUsd divided by total open interest rather than collateral-specific open interest, and that payers can only pay in their own collateral while claimers receive both tokens.
**Exploitation:** Attacker opens a position on the side that receives funding fees using the opposite collateral token, then opens a paying position with the diluted collateral; after accrual, claims full funding fees while paying only a fraction, extracting the difference from the pool.
**Escalation:** Repeated across markets/time to accumulate pool accounting mismatch leading to insolvency.
**Insight:** When a fee is split across a denominator (open interest) but settlement is restricted to a subset (positions with matching collateral), check that the denominator matches the settlement set — otherwise payers are diluted while claimers are not.