# Liquidator can liquidate user while increasing user position to any value, stealing all Market funds or bricking the contract

Liquidator can increase a user's position to 2^62-1 during liquidation because only closable=0 is checked, breaking market accounting and stealing all funds.

- Payout: Contest reward
- Severity: high
- Program: Perennial
- Credited: panprog
- Disclosed: 2023-10-26
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-10-perennial-judging/issues/5
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-1
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Perennial Market.sol liquidation logic
**Root cause:** Liquidation invariant only checks closable==0, which can be zero while pending orders allow position increase; position size and collateral checks are skipped for protected (liquidation) updates.
**Steps:**
1. User opens long=10 with minimal collateral at price $100.
2. Price moves against user; user submits close order (pending long=0 at t=200), making closable=0.
3. Before t=200 oracle commits, liquidator commits unrequested oracle version at t=190 with price $92.
4. Liquidator calls `update(0, 2^62-1, 0, 0, true)` to liquidate while increasing user's long position to max.
5. Liquidation succeeds because closable=0 and position/collateral checks are skipped.
**How found:** Code review of `_processPendingPosition` and `_invariant`: noticed closable can be zero while pending orders increase position, and liquidation skips all other checks, allowing arbitrary position increase.
**Exploitation:** Malicious liquidator waits for a user to have a pending close order (closable=0) and becomes liquidatable, then commits an unrequested oracle price and liquidates with a huge position increase. The resulting fee or price movement exceeds Market collateral, allowing maker to withdraw all funds or bricking accounting.
**Escalation:** Position size up to 2^62-1 causes fee accumulation exceeding total Market collateral, enabling full balance withdrawal by first maker; or minimal price change creates profit exceeding balance.
**Insight:** When auditing liquidation logic, check whether invariants that rely on a derived 'closable' value can be bypassed by crafting pending orders that make closable zero while still allowing position increases; verify that liquidation orders are forced to decrease position.