# partyB can leverage emergency mode for quick profits

PartyB with emergency status can open quotes priced below market then instantly close them for guaranteed profit, bypassing intended emergency-mode scope.

- Payout: Contest reward
- Severity: medium
- Program: Symmetrical
- Credited: mstpr-brainbot
- Disclosed: 2023-06-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-symmetrical-judging/issues/192
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** symmio-core PartyBFacet open/close position logic
**Root cause:** Emergency status is granted per partyB across all positions, and the open-position function does not check whether partyB is in emergency mode, so a partyB can open new quotes while emergency-enabled and immediately close them.
**Steps:**
1. PartyB (Alice) has an open position partyA won't close; she requests emergency mode activation.
2. Before the emergency-granting tx lands, Alice scans open quotes for ones with expected open price below current market (e.g. LONG 100 ETH @ $2000 vs market $2010).
3. Alice opens that quote via the open position function (no emergency-mode check).
4. Once emergency status is granted, Alice immediately closes the trade, pocketing (2010-2000)*100 = $1000.
**How found:** Reviewer read PartyBFacetImpl.sol open/close logic and noticed emergency status is global to partyB and not checked in the open-position path, enabling open-then-instant-close arbitrage.
**Exploitation:** Precondition: partyB is about to receive emergency status. Attacker front-runs the grant by opening any quote whose expected open price is favorable vs current market, then uses emergency-mode close to exit instantly for risk-free profit.
**Insight:** When a privileged 'emergency' or 'force-close' flag is scoped per-actor rather than per-position, check whether the same actor can still create new positions under that flag; the asymmetry between open and close permissions is the bug.