# `initialCollateralDeltaAmount` is incorrectly interpreted as a USD value when calculating estimated remaining collateral

GMX Synthetics DecreasePositionUtils adds a raw token amount to a USD value, mis-estimating remaining collateral and allowing users to withdraw into immediate liquidation.

- Payout: Contest reward
- Severity: high
- Program: Gmx
- Credited: Chinmay
- Disclosed: 2023-04-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-gmx-judging/issues/249
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AH-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** DecreasePositionUtils.decreasePosition collateral check
**Root cause:** initialCollateralDeltaAmount (token units) is added directly to estimatedRemainingCollateralUsd (USD units) without price conversion, so the MIN_COLLATERAL_USD check compares mismatched units.
**Steps:**
1. Open a position with collateral in a token whose decimals differ from USD precision.
2. Submit a decrease order withdrawing collateral so estimatedRemainingCollateralUsd is computed.
3. Observe `estimatedRemainingCollateralUsd += params.order.initialCollateralDeltaAmount().toInt256()` adds raw token amount.
4. MIN_COLLATERAL_USD check passes or fails incorrectly depending on token decimals.
5. If over-estimated, position becomes immediately liquidatable by keepers after withdrawal.
**How found:** Code reading of DecreasePositionUtils.decreasePosition noticed the add-back of initialCollateralDeltaAmount to a USD-denominated variable without conversion.
**Exploitation:** User withdraws collateral believing remaining collateral is sufficient; liquidation keepers immediately liquidate since liquidation orders don't adjust collateral, causing user loss.
**Insight:** When a value is subtracted then added back during estimation, verify both sides use the same unit/denomination—unit mismatches in accounting add-backs silently break threshold checks.