# Vault leverage can be increased to any value up to min margin requirement due to incorrect `maxRedeem` calculations with closable and `LEVERAGE_BUFFER`

Incorrect maxRedeem math multiplying closable by LEVERAGE_BUFFER let a user redeem more collateral than closable allowed, pushing vault leverage far above config.

- Payout: Contest reward
- Severity: high
- Program: Perennial
- Credited: panprog
- Disclosed: 2023-10-26
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-10-perennial-judging/issues/7
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** Perennial vault strategy maxRedeem / collateral accounting
**Root cause:** maxRedeem applies LEVERAGE_BUFFER to the delta (closable) position rather than the final position, so redeemable collateral exceeds what closable permits, leaving a residual position with too little collateral.
**Steps:**
1. Set market leverage=4, existing deposits $1K, positions $4K.
2. Open maker positions so makerLimit - currentMaker = $36K.
3. Deposit $11K to vault; vault opens only +$36K (total $40K) due to makerLimit.
4. Settle, then close the blocking maker position to free makerLimit.
5. Deposit dust from another user so vault pending=$48K, settled=$40K, closable=$40K.
6. Redeem $11K: maxRedeem = closable/leverage*LEVERAGE_BUFFER = $40K/4*1.2 = $12K, but position only reduced by closable ($40K) to $8K.
7. Settle and claim $11K; vault left with $8K position on $1K collateral => leverage 8 (2x config).
8. Optionally keep high leverage by opening/closing positions so long-short=maker, blocking vault position reduction.
**How found:** Code review of StrategyLib maxRedeem: noticed LEVERAGE_BUFFER multiplied against closable (delta) rather than final position, then reasoned through settled/pending/closable states to find a makerLimit-based path to realize the mismatch.
**Exploitation:** Attacker manipulates makerLimit to create a gap between settled and pending positions, then redeems in the closable..closable*LEVERAGE_BUFFER range, withdrawing collateral while the vault retains an oversized position, inflating vault leverage and liquidation risk for depositors.
**Escalation:** Can be sustained across oracle versions by making long-short=maker or short-long=maker in underlying markets to prevent vault position reduction.
**Insight:** When a buffer is meant to bound a ratio on a final state, check whether it's applied to the delta instead; and look for ways to desync settled vs pending position (makerLimit, closable) to realize otherwise-unreachable redeem amounts.