# User deposits are exposed to protocol risk before being able to do anything Low/Info · Three Sigma · Hybrid orderbook DEX · 3rd April 2024 Finding 3S-Vertex-L11 of the Vertex security review. - Report: /reports/vertex - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-04-03-vertex.pdf --- ### Description depositCollateral() and related functions transfer funds from the user, but only after the delay or the sequencer submission is the balance of the user updated. This poses a risk for the user that may lose the funds without having the opportunity to do something about them. A simple example would be having a single user in the protocol who deposited, accuring deposit multiplier. If this user withdrew, it would get some of the pending deposit collateral. ### Recommendation Endpoint::handleDepositTransfer() could move the funds to a temporary address and only when the deposit is submitted are the funds transferred to the clearing house. ### Status Acknowledged Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Admin will not be able to only pause deposits in the `Vault` due to incorrect check leading to DoSed withdrawals](https://0xsimao.com/findings/cork-protocol-able-pause-deposits-withdrawals): Cork Protocol - [If wLP is blacklisted, then user will not be able to withdraw it](https://0xsimao.com/findings/init-capital-ii-blacklisted-user-able-withdraw): INIT Capital - [Liquidations will leave dust when repaying expired maturities, making it impossible to clear bad debt putting the protocol at a risk of insolvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidations-dust-debt-insolvency): Exactly Protocol Update - Staking Contract - [Malicious user may frontrun `GoodDollarExpansionController::mintUBIFromReserveBalance()` to make protocol funds stuck](https://0xsimao.com/findings/mento-frontrun-mint-ubi-stuck): Mento