# Trading out of the money options has delta = 0 which breaks protocol assumptions of traders profit being fully hedged and can result in a loss of funds to LPs

Out-of-the-money IG options return delta=0, so trades aren't hedged and repeated OTM round-trips drain LP vault funds.

- Payout: Contest reward
- Severity: medium
- Program: Smilee Finance
- Credited: panprog
- Disclosed: 2024-02-01
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-smilee-finance-judging/issues/97
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AM-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** IG options delta-hedging vault (FinanceIGDelta)
**Root cause:** bullDelta/bearDelta return 0 when the option is out of the money, so the vault skips rebalancing even though OTM option value still moves with spot price.
**Steps:**
1. Deploy vault with base=1, side=1, strike=1.
2. Buy 100% IG Bear at price 1.0 to lock out rebalancing below strike.
3. Drop price to 0.9, buy 100% IG Bull (premium ~0.000038).
4. Raise price to 0.99, sell IG Bull for payoff ~0.001138.
5. Repeat 20x; vault base drops to 0.9785 while side stays 1.0, a ~1.07% LP loss.
6. Sell back IG Bear at price 1.0.
**How found:** Code-reading of FinanceIGDelta.bullDelta/bearDelta revealed the early `if (s <= k) return 0;` branch, contradicting the docs' claim that all trader PnL is fully hedged; confirmed with a Foundry PoC looping OTM trades.
**Exploitation:** Trader repeatedly buys OTM IG Bull below strike and sells it after a small price recovery; since delta=0 no hedge rebalance occurs, so the trader's payoff comes directly from LP vault funds.
**Escalation:** With long-dated annual options and near-100% utilization of the opposite side, all trades are unhedged; a 50% drop-and-recover yields ~3% vault loss per trade, draining the vault in ~33 trades.
**Insight:** When a protocol claims full delta hedging, check the delta function's boundary branches (OTM/ATM) for hardcoded zeros; option value is nonzero OTM even when delta is ~0, so any skipped rebalance leaks value to LPs.