# Position Manager providing the wrong strike when storing user's position data

PositionManager stored the user-supplied strike instead of IG's currentStrike, so a mismatched mint left positions unburnable and funds stuck.

- Payout: Contest reward
- Severity: medium
- Program: Smilee Finance
- Credited: jennifer37
- Disclosed: 2024-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-smilee-finance-judging/issues/23
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** PositionManager periphery contract / IG DVP mint
**Root cause:** IG.mint ignores the passed strike and uses financeParameters.currentStrike, but PositionManager persists params.strike in ManagedPosition, so stored strike diverges from the actual on-chain position.
**Steps:**
1. Call `pm.mint` with `strike = ig.currentStrike() + 1` (or a stale epoch strike) and notionalUp=10 ether.
2. IG.mint mints using `financeParameters.currentStrike`, ignoring the supplied strike.
3. PositionManager saves `_positions[tokenId].strike = params.strike` (the wrong value).
4. Call `pm.sell` with that tokenId; burn passes the stored wrong strike to IG, which reverts `PositionNotFound()`, leaving funds stuck.
**How found:** Code reading of PositionManager.mint vs IG.mint revealed IG discards the strike argument and uses currentStrike, while PositionManager persists the user-supplied strike; a test with strike+1 confirmed the burn revert.
**Exploitation:** User mints near an epoch rollover with the old epoch's strike; tx executes after rollEpoch so IG uses the new currentStrike while PositionManager records the old one, permanently blocking sell/burn of that position.
**Insight:** When a periphery contract caches parameters that the core contract silently overrides (here IG ignores the strike arg), compare what the core actually uses against what the periphery stores; any divergence becomes a stuck-state bug on later calls that replay the stored value.