# `partyA` can inflate the uPnL with no cost

PartyA opens a LIMIT long via a self-controlled partyB with openedPrice 0, locking zero value and inflating uPnL to dodge liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Symmetrical
- Credited: shaka
- Disclosed: 2023-06-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-symmetrical-judging/issues/181
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** PartyBFacetImpl.openPosition (symmio-core)
**Root cause:** For LONG LIMIT positions there is no minimum bound on openedPrice; when openedPrice < requestedOpenPrice the proportional locked values are unlocked, so openedPrice=0 yields zero locked value while uPnL is computed from (currentPrice - 0).
**Steps:**
1. PartyA creates a quote: partyBsWhiteList=[bob], positionType=LONG, orderType=LIMIT, price=100e18, quantity=1e18, cva=22e18, mm=75e18, lf=3e18.
2. PartyA (controlling bob) calls openPosition with filledAmount=1e18 and requestedOpenPrice=0.
3. Observe lockedValues become 0 and partyA uPnL inflates by (currentPrice - 0) * 1e18.
4. Repeat with fresh partyB accounts to keep uPnL inflated until prices recover.
**How found:** Code review of PartyBFacetImpl.openPosition: noticed no minimum check on openedPrice for long positions and that openedPrice below requestedOpenPrice unlocks proportional locked values, leading to the zero-price hypothesis.
**Exploitation:** Attacker controls both partyA and a whitelisted partyB; opens a LIMIT long at openedPrice 0 so no collateral is locked, inflating partyA's unrealized PnL and avoiding liquidation while waiting for favorable price movement. PartyB is eventually liquidated (no liquidator incentive since fee is 0), correcting the inflation.
**Escalation:** Repeat across multiple controlled partyB accounts to sustain inflated uPnL; buy time for other positions to recover.
**Insight:** In perp/quote protocols, check that the fill price is bounded relative to the quote price; a fill price far below requested silently zeroes locked collateral and lets self-matched accounts manufacture uPnL to dodge liquidation.