# The sign of delta hedge amount can be reversed by malicious user due to incorrect condition in `FinanceIGDelta.deltaHedgeAmount`

Incorrect absolute-value check in delta hedge calculation reverses sign of negative hedge amounts, letting attacker force vault to hedge at manipulated prices and drain funds.

- Payout: Contest reward
- Severity: high
- Program: Smilee Finance
- Credited: panprog
- Disclosed: 2024-02-01
- Write-up quality: 9/10
- Original: https://github.com/sherlock-audit/2024-02-smilee-finance-judging/issues/36
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** FinanceIGDelta.deltaHedgeAmount in Smilee Finance contracts
**Root cause:** The final check compares absolute value of tokensToSwap to sideTokensAmount and sets tokensToSwap to positive sideTokensAmount when true, even if tokensToSwap is negative, reversing the sign of the delta hedge.
**Steps:**
1. Deploy vault and IG, set price significantly above strike.
2. Buy IG bull options for 50% of vault amount: forces vault to buy side tokens for delta hedge.
3. Buy IG bull options for another 50%: delta hedge amount becomes -sideTokens, triggering the incorrect check and setting it to +sideTokens, so vault sells instead of buys.
4. Manipulate Uniswap pool: buy up to edge of allowed range (+1.8%), provide liquidity in narrow range (+1.8%..+2.4%).
5. Open/close any IG position with amount 1 wei to force vault to delta hedge large amount at inflated price.
6. Remove liquidity and sell back, profiting from price difference.
**How found:** Code review of delta hedge calculation revealed that the final check uses absolute value and always sets positive amount, which is incorrect for negative hedge amounts.
**Exploitation:** Attacker manipulates Uniswap pool to inflate price, then triggers vault re-hedge with a tiny trade, causing vault to buy side tokens at inflated price. Attacker's liquidity position profits from the price difference, draining vault funds.
**Escalation:** Repeat process to drain all vault funds; also causes protocol insolvency if price moves before next hedge.
**Insight:** When reviewing arithmetic checks, verify that sign is preserved and conditions match the intended direction of value flow; absolute value comparisons can hide sign errors.