# Incorrect premium calculation in OracleMaker

OracleMaker's premium/position rate depends on free collateral, letting an LP deposit, open a position at reduced premium, then withdraw.

- Payout: Contest reward
- Severity: medium
- Program: Perpetual
- Credited: jokr
- Disclosed: 2024-02-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-perpetual-judging/issues/137
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** OracleMaker position-rate/premium calculation (Solidity)
**Root cause:** _getPositionRate divides openNotional by maxPositionNotional, which scales with collateralForOpen (free collateral). More LP collateral lowers the position rate and thus the premium, though exposure is unchanged.
**Steps:**
1. OracleMaker holds a 100 ETH short position; a user opening a 10 ETH long should pay a premium.
2. User deposits large collateral as LP, raising collateralForOpen and maxPositionNotional.
3. uncappedPositionRate = (-openNotional * 1e18) / maxPositionNotional shrinks, reducing premium.
4. User opens the long at near-market price, then withdraws the LP collateral.
**How found:** Code reading of _getPositionRate: noticed uncappedPositionRate depends on maxPositionNotional, which is derived from free collateral, so premium scales with LP deposits rather than exposure alone.
**Exploitation:** Deposit collateral into OracleMaker to inflate maxPositionNotional, open a position at a reduced spread/premium, then withdraw the collateral. Order delay and whitelisting limit atomicity.
**Insight:** When a pricing/spread formula divides by a capacity term derived from collateral, check whether depositing collateral changes the price a user pays for the same exposure.