# Unbounded user price credited as collateral

User-supplied fill, open or intent price used in PnL without a bound against the oracle or quote price

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2024-08-17. Updated 2026-11-06._

## How it works
A protocol lets a user supply a price field (intent price, opened price, fill price) that feeds a PnL or collateral formula, but never bounds that field against the oracle/last price or the user's own quote. Collateral is required only against the oracle price, so the user-supplied price can be set arbitrarily far from it. The settlement formula then credits the difference as profit or unlocks locked value, turning a tiny or zero deposit into large collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-4.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-6.md). The broken assumption: "the price the user submits is close to the real price because they must post collateral for it." That only holds if the collateral check references the same price the PnL formula uses.

## Where it shows up
- A settlement/PnL formula like `(toVersion.price - Intent.price) * taker()` credited to collateral, while order creation checks collateral against `position * lastVersion.price` [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-4.md)
- LIMIT orders where `openedPrice` has no minimum bound, and `openedPrice < requestedOpenPrice` unlocks proportional locked value [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-6.md)
- Spread or quote formulas that take the maker's current position but ignore the incoming order amount [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-1.md)
- Any field named price/openPrice/fillPrice/intent.price that is user-supplied and reaches a PnL, collateral, or unlock calculation

## How to review
Find every user-supplied price that enters a PnL or collateral formula. The invariant: the collateral required at order creation must be computed from the same price the settlement formula uses, and that price must be bounded relative to the oracle/quote price (e.g. within a tolerance). For LIMIT fills, require `openedPrice >= requestedOpenPrice` (or a bound) so a fill cannot unlock value. For maker spreads, confirm the incoming order size is an input to the spread formula and that zero-crossing is evaluated with the post-trade position [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-1.md).

## How finders spotted it
- Compared the CheckpointLib settlement PnL formula against the order-creation collateral check, noticing `Intent.price` was unbounded while collateral depended only on `position * lastVersion.price` [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-4.md)
- Read `fillOrder`/`_getBasePriceWithSpread` and saw the order amount parameter was unused in the spread, then reasoned about the zero-crossing case where the maker thinks it de-risks but accumulates opposite exposure [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-1.md)
- Read `PartyBFacetImpl.openPosition`, noticed no minimum check on `openedPrice` for longs and that a price below the requested one unlocks proportional value, then formed the zero-price hypothesis [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-6.md)

## Variants seen
- Inflated intent price at settlement minting PnL collateral from a small deposit [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-4.md)
- Zero opened price on a LIMIT long unlocking all locked value while uPnL is computed from `currentPrice - 0` [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-6.md)
- Spread ignoring order size, bypassed by a reverse-then-open sequence to force oracle-price quotes [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-1.md)

## Impact and severity
Direct theft of funds via inflated PnL collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-4.md); dodging liquidation by manufacturing uPnL at no cost, repeatable across controlled accounts to buy time for other positions [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-6.md); bypassing dynamic premium to trade at raw oracle price [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-1.md). Severity rises with repeatability across accounts and with the size of the unbounded field.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-08-perennial-v2-update-3%3AH-4.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AM-6.md