# Suspended PartyBs can bypass the withdrawal restriction by exploiting `fillCloseRequest`

Suspended PartyB uses a fresh PartyA wallet to open a losing position against itself, then fills the close request to move funds out despite withdrawal suspension.

- Payout: Contest reward
- Severity: medium
- Program: Symmetrical
- Credited: 0xcrunch
- Disclosed: 2023-06-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-symmetrical-judging/issues/229
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Symmio-core AccountFacet / fillCloseRequest
**Root cause:** The notSuspended modifier guards withdraw/withdrawTo but not openPosition or fillCloseRequest, so a suspended PartyB can still settle positions and route value through a PartyA account.
**Steps:**
1. Suspended PartyB creates a PartyA wallet.
2. PartyA opens a position at an unfavorable price with partyBsWhiteList set to the suspended PartyB only.
3. PartyB fills the open position, immediately realizing a loss for PartyB and gain for PartyA.
4. PartyA requests close; PartyB calls `fillCloseRequest(quoteId, filledAmount, closedPrice, upnlSig)` to settle.
5. PartyA calls `deallocate` then `withdraw` to move gains out of the protocol.
**How found:** Code review of AccountFacet: noticed notSuspended only on withdraw/withdrawTo, then traced settlement paths (openPosition, fillCloseRequest) that move value without the modifier.
**Exploitation:** Attacker controls both PartyA and PartyB; the zero-sum position transfers value from the suspended PartyB to the fresh PartyA, which is not suspended and can withdraw.
**Insight:** When a protocol suspends an account to freeze funds, enumerate every value-moving path (settlement, fills, internal transfers), not just direct withdrawal functions; a second self-controlled account can launder the balance.