# Malicious trader can bypass utilization buffer

Trader opens maker then taker position on separate accounts, closes maker, pushing utilization to 100% and blocking all withdrawals and BalancedVault redeems.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: ast3ros
- Disclosed: 2023-05-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-perennial-judging/issues/75
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-8
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:chained vuln:business-logic vuln:dos

**Target:** Product.sol utilization buffer / takerInvariant on closeMake
**Root cause:** takerInvariant is only enforced on open/close taker and close make checks next amounts, so closing a maker position after opening a taker position lets utilization reach 100% without violating the invariant.
**Steps:**
1. State: maker=900, taker=800 (10% buffer respected)
2. Account 1 opens maker +100 -> maker=1000
3. Account 2 opens taker +100 -> taker=900 (still within buffer)
4. Account 1 closes maker -100 and withdraws collateral
5. Result: maker=taker=900, utilization=100%, takerInvariant still passes
**How found:** Code review of takerInvariant enforcement points: noticed closeMake only checks next-amount utilization <=100%, and that maker/taker separation across accounts allows sequencing to bypass the intended buffer.
**Exploitation:** Attacker uses two accounts (maker and taker cannot coexist on one product), opens maker to expand capacity, opens taker against it, then closes maker atomically before next settlement to avoid PnL exposure, leaving utilization at 100% and blocking maker withdrawals and BalancedVault redeems across linked markets.
**Escalation:** Linking markets via BalancedVault: fully utilizing a small market (e.g. $100 PEPE) blocks redeems of a large market (e.g. $1M ETH), creating orders-of-magnitude damage vs cost.
**Insight:** When a safety buffer is enforced only on one side of a state transition, check whether a two-account open/close sequence can leave the invariant satisfied at the boundary while violating its intent; also check cross-vault coupling for asymmetric DoS leverage.