# Leveraged trader with small collateral can create a riskless position until settlement

Highly leveraged Perennial trader closes position to trigger self-liquidation, keeping a zero-collateral position whose losses become protocol shortfall.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: cergyk
- Disclosed: 2023-05-05
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-05-perennial-judging/issues/104
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-11
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** Perennial Product/Collateral contracts (closeTake, liquidate)
**Root cause:** closeTake does not enforce maintenanceInvariant, so paying takerFee can push a position unhealthy; liquidate then pays a fixed minimum incentive (liquidationFee*minCollateral = 0.5 DSU) allowing full collateral withdrawal while position stays open.
**Steps:**
1. Open taker position at ~50x leverage with collateral = MIN_COLLATERAL (0.5 DSU), notional 25 DSU
2. In same tx call `closeTake` to close position, paying takerFee (0.1%) which makes position instantly liquidatable
3. Call `liquidate` on own position, withdrawing entire 0.5 DSU collateral
4. Position remains open with 0 collateral until next oracle settlement
5. At settlement: positive PnL credited to collateral and withdrawable; negative PnL becomes protocol shortfall via OptimisticLedger
**How found:** Code review of closeTake noting missing maintenanceInvariant check, combined with reading liquidate's fixed minimum incentive formula liquidationFee*minCollateral, deducing a self-liquidation path to zero-collateral exposure.
**Exploitation:** Attacker opens max-leverage position at minCollateral, self-liquidates in one tx to reclaim collateral while retaining notional exposure; repeated across accounts to extract gains and dump losses as shortfall on the protocol. Escalation variant: open offsetting long/short positions at MIN_COLLATERAL so one drifts near 10% of MIN_COLLATERAL, then apply the same self-liquidation trick.
**Escalation:** Multiple accounts/positions amplify extraction; offsetting long/short pairs to reach sub-minCollateral state cheaply.
**Insight:** When a close/partial-close path skips the maintenance invariant but charges fees, check whether the fee itself can push the account below maintenance and be immediately self-liquidated for a fixed minimum incentive — the incentive floor vs. tiny collateral is the arbitrage.