# Deferred Liquidation can get stuck at step one of the liquidation process if the nonce increment

Symmio deferred liquidation locks a Muon signature tied to PartyA's nonce; a later chargeFundingRate bumps the nonce, invalidating step two and freezing the account's assets.

- Payout: Contest reward
- Severity: medium
- Program: Symmetrical Update 2
- Credited: xiaoming90
- Disclosed: 2024-06-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-symmetrical-update-2-judging/issues/8
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-symmetrical-update-2%3AM-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:signature-replay

**Target:** Deferred liquidation facet / Muon-signed liquidation signatures
**Root cause:** The deferred liquidation signature binds PartyA's nonce at the historical liquidation block; chargeFundingRate increments PartyA's nonce after step one, so the signature no longer matches and deferredSetSymbolsPrice reverts.
**Steps:**
1. PartyA becomes liquidatable at T10 with nonce 555; liquidator obtains Muon signature (liquidationId=100, timestamp=T10, partyANonces=555).
2. Liquidator calls `deferredLiquidatePartyA` with the signature; liquidationId 100 locked, PartyA marked liquidated/frozen.
3. At T21 a PartyB calls `chargeFundingRate(partyA, quoteIds, rates, upnlSig)`; solvency check passes and PartyA's nonce increments to 556.
4. Liquidator calls `deferredSetSymbolsPrice` at T22; signature check compares nonce 555 vs current 556 and reverts.
5. Re-fetching the Muon signature for T10 still yields nonce 555, so step two can never succeed; liquidation stuck.
**How found:** Code reading of the deferred liquidation flow: noticed the Muon signature binds partyANonces and that chargeFundingRate increments the nonce at the end of its call, then reasoned that multi-block liquidation staging plus a nonce bump breaks the signature check.
**Exploitation:** Any whitelisted PartyB (or normal periodic funding-rate charging) bumps the nonce between liquidation stages, permanently invalidating the historical liquidation signature and freezing the account's collateral with no recovery path.
**Insight:** When a signed authorization binds an account nonce, enumerate every function that can increment that nonce and check whether any can run between the stages that consume the signature; multi-step liquidation flows are prime targets for nonce-invalidation griefing.