# PnL is incorrectly counted as collateral when determining whether to close positions automatically

GMX counted unrealized PnL as collateral in willPositionCollateralBeSufficient, letting a profitable position reduce collateral to 1 wei and leave the pool uncovered on a price gap.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/154
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-22
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** GMX Synthetics PositionUtils.willPositionCollateralBeSufficient / DecreasePositionUtils
**Root cause:** remainingCollateralUsd adds values.positionPnlUsd to the collateral amount before comparing against minCollateralUsdForLeverage, so unrealized profit substitutes for real collateral.
**Steps:**
1. Open a leveraged position that accrues large unrealized PnL.
2. Call decreasePosition reducing collateral down to 1 wei of the collateral token; willPositionCollateralBeSufficient passes because PnL is added to remainingCollateralUsd.
3. Position now has ~zero real collateral; on a sudden price gap down the user loses only 1 wei while the pool absorbs the loss.
4. No keeper mechanism can reduce leverage once only 1 wei remains; position can only be closed via liquidation.
**How found:** Code review of PositionUtils.willPositionCollateralBeSufficient, noticing positionPnlUsd is added into remainingCollateralUsd before the min-collateral check.
**Exploitation:** Position owner with large unrealized profit withdraws nearly all collateral via decrease orders, leaving 1 wei, then waits for a price gap; downside risk is shifted to the pool while the owner's exposure is capped at 1 wei.
**Insight:** When a protocol treats unrealized PnL as collateral for margin/min-collateral checks, test whether a profitable position can withdraw real collateral to near-zero and externalize gap risk to the pool; check whether keepers can still act on such positions.