# In LeverageModule.executeOpen/executeAdjust, vault.checkSkewMax should be called after updating the global position data

Flatmoney LeverageModule checks skew max before updating global position data, letting positions open that push the system past the 120% long-skew limit.

- Payout: Contest reward
- Severity: medium
- Program: Flatmoney
- Credited: ge6a
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-flatmoney-judging/issues/143
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AM-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LeverageModule.executeOpen/executeAdjust on FlatcoinVault
**Root cause:** checkSkewMax reads stableCollateralTotal before updateGlobalPositionData settles profit/loss into it, so the skew fraction is computed against a stale denominator.
**Steps:**
1. Set stableCollateralTotal=90e18, sizeOpenedTotal=100e18, lastPrice=1800e18.
2. Open position with additionalSize=5e18 at fresh price 2000e18.
3. executeOpen calls `vault.checkSkewMax(5e18)` first: (100+5)/90 = 1.1667 < 1.2, passes.
4. Then updateGlobalPositionData computes profitLossTotal=10e18 and reduces stableCollateralTotal to 80e18.
5. Actual skew after update: (100+5)/80 = 1.3125 > 1.2, exceeding skewFractionMax.
**How found:** Code reading of executeOpen ordering: noticed checkSkewMax consumes stableCollateralTotal which updateGlobalPositionData mutates, then constructed a numeric example showing pass-before/fail-after.
**Exploitation:** Trader opens or adjusts a long position when collateral price has risen; the pre-update skew check passes while the post-settlement skew exceeds the cap, letting the system become over-leveraged toward longs.
**Insight:** When a guard reads state that a later call in the same function mutates, verify the guard uses post-mutation values; profit/loss settlement changing a denominator is a classic stale-check ordering bug.