# Withdrawal caps can be bypassed by opening positions against the SpotHedgeBaseMaker

SpotHedgeBaseMaker base-token deposits bypass CircuitBreaker accounting, letting an attacker inflate vault TVL via short positions and withdraw past the high-water-mark cap.

- Payout: Contest reward
- Severity: medium
- Program: Perpetual
- Credited: IllIllI
- Disclosed: 2024-02-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-perpetual-judging/issues/117
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** SpotHedgeBaseMaker / CircuitBreaker vault withdrawal limiter
**Root cause:** CircuitBreaker only tracks quote-token net flows and uses stale TVL from before the sync interval; base-token deposits to SpotHedgeBaseMaker are not counted until swapped into quote tokens and deposited to the vault, so a swap inflates TVL without updating the limiter's baseline.
**Steps:**
1. Attacker holds inflated 'fund' amount (e.g. via separate exploit).
2. Convert fund to margin and open a large short base position against SpotHedgeBaseMaker.
3. SHBM hedges by swapping its base-token balance to quote tokens via UniswapV3 `_uniswapV3ExactOutput`.
4. Acquired quote tokens are deposited to the vault via `_deposit`, raising TVL to TVL+Y.
5. CircuitBreaker's `liqTotal` baseline still reflects old TVL, so withdrawal limit becomes `TVL.old*X% + Y`.
6. Optionally flash-loan to skew the UniswapV3 base/quote rate within price band limits to maximize Y, then withdraw up to 100% of TVL.
**How found:** Code review of SpotHedgeBaseMaker.fillOrder and LibLimiter.status: noticed base-token deposits aren't reflected in CircuitBreaker accounting until swapped, and that the limiter compares future liq against a stale TVL baseline, enabling TVL inflation between sync intervals.
**Exploitation:** Precondition: attacker controls an inflated fund balance. They open a large short base position, forcing SHBM to swap base→quote and deposit quote into the vault, inflating TVL beyond the limiter's stale baseline. A flash loan can skew the UniswapV3 pool rate within the allowed price band to maximize quote acquired, then the attacker withdraws more than the intended X% cap, potentially draining the vault.
**Escalation:** Chained with a separate fund-inflation bug and a flash-loan price skew to push withdrawable amount toward 100% of TVL.
**Insight:** When a rate limiter uses a high-water-mark baseline refreshed only per interval, look for any path that increases the denominator/TVL (e.g. maker hedging swaps depositing collateral) without registering a corresponding flow—those unaccounted inflows let you withdraw against inflated TVL.