# Unrealized PnL as Collateral

Does the sufficiency check count unrealized profit, pending PnL, or pending fees as real collateral?

_Area: DeFi accounting and math bugs. Seen in 4 disclosed reports; latest 2025-01-14. Updated 2026-10-23._

## How it works
A solvency or margin check is supposed to compare real, settled collateral against real obligations. The assumption that breaks is that every value fed into that check is either realized or fully aggregated. When unrealized profit (uPnL), pending PnL from open intents, or deferred fees are added to the collateral side, or omitted from the debt side, the check passes on value that does not yet exist. The account can then withdraw real assets or open more exposure against phantom equity, and the shortfall lands on the pool or counterparty.

## Where it shows up
- Collateral math that adds `positionPnlUsd`, `upnl`, or `newGuarantee` before comparing to a minimum [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-22.md).
- Health checks that adjust for only the order being processed, not all pending orders for the account [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-1.md).
- Guaranteed-execution orders whose fees settle later and are excluded from margin [E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-3.md).
- Two-phase liquidation where the counterparty can still deallocate or close between phases [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-2.md).
- Solvency functions that subtract close-price losses but never add close-price gains [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-7.md).

## How to review
Identify every value entering the sufficiency comparison and classify it as realized or unrealized. The invariant: collateral counted in a withdrawal or liquidation check must be settled and withdrawable now; unrealized PnL and pending fees must be excluded from collateral or included symmetrically on the obligation side. Confirm the check aggregates all pending orders and fees for the account, not just the current one [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-1.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-3.md). For two-phase flows, confirm the counterparty cannot change state between fund transfer and settlement [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-2.md). For close-price deltas, confirm profit and loss are handled symmetrically [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-7.md).

## Variants seen
- Pending PnL from other intents ignored, letting stacked intents drain the market [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-1.md).
- Selective liquidation inflating partyA uPnL, then deallocation dumps bad debt [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-2.md).
- uPnL counted as collateral, letting a profitable position withdraw to near-zero [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-22.md).
- Guaranteed orders with deferred fees excluded from collateral [E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-3.md).
- Asymmetric close-price delta understating available balance [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-7.md).

## Impact and severity
Critical: full market drain [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-1.md), fund theft via inflated uPnL [E2](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-2.md), uncovered pool on a price gap [E3](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-22.md), bad debt from unaccounted fees [E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-3.md). Severity rises when the phantom value is withdrawable and when price moves widen the gap between unrealized and realized.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-22.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2025-01-perennial-v2-4-update%3AH-3.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-7.md