# Pending keeper and position fees are not accounted for in vault collateral calculation which can be abused to liquidate vault when it's small

Vault leverage calc ignores pending keeper/position fees, letting attackers spam tiny deposits to inflate real leverage and liquidate a small vault.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: panprog
- Disclosed: 2023-10-26
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-perennial-judging/issues/28
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** Perennial Vault / Market collateral accounting
**Root cause:** Vault computes collateral from market local.collateral which excludes pending keeper and position fees, while Market health checks subtract those pending fees, so vault leverage is understated relative to actual market collateral.
**Steps:**
1. Observe Vault loads context.collaterals[marketId] = local.collateral, which excludes pending fees.
2. Note Market subtracts newPendingPosition.fee and .keeper from pendingCollateral in margin/maintenance checks.
3. From many accounts, submit minimum-size deposits in the same oracle version to accrue keeper fees.
4. Vault's computed collateral stays high while actual market collateral drops, raising real leverage.
5. Push leverage to max, then commit a slightly worse price to trigger liquidation of the vault.
**How found:** Code reading comparing Vault's collateral loading (local.collateral) against Market's health checks that subtract pending keeper/position fees, spotting the accounting mismatch.
**Exploitation:** Attacker with multiple accounts makes many tiny deposits in one oracle version; each incurs keeper fees deducted from market collateral but not from vault's leverage calc, inflating actual leverage until the vault breaches maintenance and can be liquidated.
**Escalation:** Chains with a separate issue that sets vault leverage to max, then this issue reduces collateral to maintained level before a worse-price commit to force liquidation.
**Insight:** When two components compute 'collateral' differently, look for fees or pending deltas subtracted in one health check but not the other; small TVL plus per-action fees lets an attacker drain collateral via spam deposits to shift leverage.