# Positions can still be liquidated even if orders to prevent it can't execute

GMX liquidation updates internal accounting without token transfers, so paused collateral (e.g. USDC) blocks users from closing/adding collateral but keepers can still liquidate them.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/168
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** GMX Synthetics position liquidation and decrease-order flow
**Root cause:** Liquidation path only calls increment*/applyDelta* to update internal accounting and never transfers collateral tokens, while close-position and add-collateral orders do real transfers that revert when the token is paused.
**Steps:**
1. Collateral token (e.g. USDC) is paused, so transferFrom reverts.
2. User submits decrease-position or add-collateral order to avoid liquidation; execution reverts on token transfer.
3. Liquidation keeper executes liquidation order; DecreasePositionCollateralUtils.getLiquidationValues sets remainingCollateralAmount=0 and pnlAmountForUser=0 without transferring tokens.
4. Accounting updated via increment*/applyDelta*; position liquidated despite user being unable to act.
**How found:** Code reading comparing liquidation path (accounting-only updates) against decrease/add-collateral orders (real token transfers) to spot the asymmetry under token pause.
**Exploitation:** Keeper liquidates positions while collateral token transfers are paused; users cannot close or top up because their orders require real token transfers that revert.
**Insight:** When two code paths reach the same economic outcome, check whether one performs external token transfers and the other only updates accounting; any token-level pause or blacklist creates an asymmetry attackers/keepers can exploit.