# Long traders unable to withdraw their assets

Flatmoney's invariant check reverts when long trader profit exceeds LP stable collateral, bricking all deposit/withdraw/close/liquidate functions and trapping user funds.

- Payout: Contest reward
- Severity: medium
- Program: Flatmoney
- Credited: CL001
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-flatmoney-judging/issues/196
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AM-6
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** FlatcoinVault invariant check / global position accounting
**Root cause:** When profitLossTotal exceeds stableCollateralTotal, stableCollateralTotal is floored at 0 while marginDepositedTotal absorbs the full profit, so trackedCollateral exceeds actual collateralBalance and _getCollateralNet reverts.
**Steps:**
1. Set state: long margin 50 ETH, LP 50 ETH, collateralBalance 100 ETH, stableCollateralTotal 50, marginDepositedTotal 50.
2. Long position gains 51 ETH profit.
3. Trigger updateGlobalPositionData via executeOpen/Adjust/Close or liquidation: newMarginDepositedTotal = 50 + 51 = 101; newStableCollateralTotal = 50 - 51 = -1 floored to 0.
4. Now collateralBalance=100 but trackedCollateral=101, so `_getCollateralNet` reverts with InvariantViolation("collateralNet").
5. All user entrypoints (deposit, withdraw, open, adjust, close, liquidate) revert, bricking protocol.
**How found:** Code review of InvariantChecks._getCollateralNet and updateGlobalPositionData accounting; noticed asymmetric capping of LP loss at zero versus uncapped trader profit, producing a tracked-vs-actual collateral mismatch.
**Insight:** When auditing accounting invariants, check whether loss capping on one side (floored at zero) is mirrored on the profit side; asymmetric clamping creates tracked-vs-actual balance drift that can permanently brick invariant-guarded entrypoints.