# PartyA's allocated balance could increase after `deferredLiquidatePartyA` is executed

Symmetrical deferred liquidation: a liquidator who is also a PartyA can have re-credited fees inflate the liquidation fee paid out, overpaying the liquidator.

- Payout: Contest reward
- Severity: medium
- Program: Symmetrical Update 2
- Credited: xiaoming90
- Disclosed: 2024-06-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-symmetrical-update-2-judging/issues/6
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-symmetrical-update-2%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:liquidation

**Target:** DeferredLiquidationFacet / LiquidationFacet (Solidity, Symm protocol)
**Root cause:** deferredLiquidatePartyA zeroes allocatedBalances, but liquidation fees credited to the same address later can make availableBalance positive in deferredSetSymbolsPrice, which assumes it is zero or negative and miscomputes remainingLf.
**Steps:**
1. Bob is both a liquidator and a PartyA (permissionless).
2. Bob's PartyA account is liquidated via `deferredLiquidatePartyA`, zeroing `allocatedBalances[Bob]`.
3. Bob's earlier liquidations settle, crediting `allocatedBalances[Bob] += lf/2` (e.g. 1000).
4. `deferredSetSymbolsPrice` computes `availableBalance` = +800 (positive), so `remainingLf = lf - (-availableBalance)` = 100 - (-800) = 900.
5. Liquidator receives 900 instead of the locked LF of 100; 800 is drained from Bob.
**How found:** Code reading of the deferred liquidation flow: noticed the invariant that allocatedBalances must not increase after deferredLiquidatePartyA, then traced the liquidation-fee credit path in LiquidationFacetImpl that violates it.
**Exploitation:** Requires the victim PartyA to also act as a liquidator and receive liquidation fees between step 1 and step 2 of the deferred liquidation; the inflated remainingLf is paid out to the liquidator, exceeding the locked LF.
**Insight:** When a two-step deferred process zeroes a balance and a later step assumes it stays zero/negative, check every other code path that credits that same mapping between the steps — especially fee/reimbursement credits to addresses that can hold multiple roles.