# MultiAccount `depositAndAllocateForAccount` function doesn't scale the allocated amount correctly, failing to allocate enough funds

MultiAccount.depositAndAllocateForAccount reused raw collateral amount (6-dec USDC) as 18-dec allocation, allocating 1e12x too little and risking liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Symmetrical
- Credited: panprog
- Disclosed: 2023-08-28
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-08-symmetrical-judging/issues/15
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-08-symmetrical%3AM-4
- Tags: domain:web3 kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:regression technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** MultiAccount.depositAndAllocateForAccount in symmio-core
**Root cause:** Allocated balances are tracked in 18 decimals, but depositAndAllocateForAccount passes the raw collateral-token amount (e.g. 6-dec USDC) directly to allocate() without scaling, unlike AccountFacet.depositAndAllocate which multiplies by 1e18/10**decimals.
**Steps:**
1. Call `MultiAccount.depositAndAllocateForAccount(account, amount)` with USDC (6 decimals), e.g. amount = 1e6.
2. Observe `depositFor(account, 1e6)` credits correct collateral.
3. Observe `innerCall(account, allocate(1e6))` allocates only 1e6 in 18-dec accounting, i.e. 1e12x too small (dust).
4. Compare with `AccountFacet.depositAndAllocate` which scales via `(amount * 1e18) / 10**decimals`.
5. Result: allocatedBalance is dust; user near liquidation threshold gets liquidated despite depositing.
**How found:** Compared the scaling logic in AccountFacet.depositAndAllocate against MultiAccount.depositAndAllocateForAccount and noticed the same raw `amount` was reused for both depositFor and allocate, recalling the identical bug (issue 222) from the prior contest.
**Insight:** When a protocol tracks internal balances in fixed 18 decimals but accepts multi-decimal collateral, audit every entrypoint that bridges the two; helper/aggregator contracts (MultiAccount) often duplicate logic and drop the scaling that the canonical facet applies.