# Position closure might always revert in some cases due to allocatedBalances being unsigned, preventing the user from closing its positions

Unsigned allocatedBalances in Symmetrical underflow when closing one of two hedged opposite positions, reverting closure and locking both parties' funds.

- Payout: Contest reward
- Severity: medium
- Program: Symmetrical
- Credited: panprog
- Disclosed: 2023-08-28
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-08-symmetrical-judging/issues/10
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** symmio-core position close / solvency accounting (LibAccount, AccountStorage)
**Root cause:** allocatedBalances stored as uint; applying a position's realized loss can drive the balance negative, causing underflow revert in solvency checks even when total account value (allocated + upnl) is positive.
**Steps:**
1. Open two opposite positions (LONG 100 @1, SHORT 100 @1) between partyA and partyB with minimal allocated balance.
2. Price doubles to 2; total upnl nets to 0 so account stays solvent.
3. Call `requestToClosePosition(1, ...)` then `fillCloseRequest(1, ...)` -> reverts `LibSolvency: PartyB will be liquidatable` (underflow applying loss).
4. Call `requestToClosePosition(2, ...)` -> reverts `LibSolvency: partyA will be liquidatable`.
5. Both positions unclosable until price returns near entry; emergencyClosePosition also reverts.
**How found:** Code review of AccountStorage uint allocatedBalances and LibAccount solvency formula (allocated + upnl); reasoned that a single position's loss applied on close can exceed allocated balance even when net account value is positive, then reproduced with a hedged long/short test.
**Exploitation:** Not an attacker-driven exploit; occurs naturally when a user holds multiple positions where individual losses exceed allocated balance while net upnl keeps account solvent. Funds remain locked in protocol.
**Escalation:** With leverage, required allocation to close the losing leg first (e.g. 99000 vs 20000 collateral) is orders of magnitude beyond user's funds, permanently trapping positions; also blocks partyB emergencyClosePosition.
**Insight:** When auditing perp/derivative accounting, check whether per-position realized PnL is applied against a shared unsigned balance: hedged or multi-position accounts can have positive net equity but negative per-leg balance, so test closing each leg independently rather than only net solvency.