Submitted by klau5, also found by KrisApostolov, Toshii, 0xc0ffEE, codegpt, clash, ge6a, QiuhaoLi, parsely, Tendency, wintermute, bin2chen, Blockian, __141345__, Evo, 0xbranded, visualbits, Udsen, 0xvj, nirlin, ak1, jasonxiale, pontifex, Aymen0909, DanielArmstrong, AkshaySrivastav, savi0ur, RED-LOTUS-REACH, crunch, sces60107, pks_, Mike_Bello90 (1, 2), tnquanghuy0512, circlelooper, ubermensch, asui, oakcobalt, bart1e, Anirruth (1, 2), 0xklh, blutorque, Baki, Snow24, Yanchuan, Jiamin, SBSecurity, kutugu, LokiThe5th, Juntao, nobody2018, juancito, carrotsmuggler, ladboy233, mert_eren, BugzyVonBuggernaut, GangsOfBrahmin, said, rokinot, ayden, 0xDING99YA, lanrebayode77, peakbolt, chainsnake, T1MOH, Inspex, gjaldon, SpicyMeatball, LFGSecurity, ke1caM, Norah, auditsea, dirk_y, max10afternoon, tapir, spidy730, HChang26, grearlake, 0xCiphky, chaduke, volodya, sl1, 0x3b, Nyx, kodyvim, ravikiranweb3, ABA, 0xWaitress, 0xsurena, rvierdiiev, degensec, Kow, Krace, mahdikarimi, and sh1v
https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L199-L205 
https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/perp-vault/PerpetualAtlanticVault.sol#L359-L361 
https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/core/RdpxV2Core.sol#L772-L774
RdpxV2Core.settle reverts and the protocol stops.
If a collateral token(WETH) is arbitrarily sent to PerpetualAtlanticVaultLP, the values of collateral.balanceOf(address(this)) and _totalCollateral will be different.
Since PerpetualAtlanticVaultLP.subtractLoss requires that collateral.balanceOf(address(this)) exactly match with _totalCollateral - loss, PerpetualAtlanticVaultLP.subtractLoss will be failed if an attacker arbitrarily transfers collateral tokens to the PerpetualAtlanticVaultLP contract.
https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L199-L205
Since there is no function that synchronizes _totalCollateral with collateral.balanceOf(address(this)) without moving tokens, even admin cannot fix.
This is exploit PoC. Add this test case at tests/perp-vault/Unit.t.sol
Use >= instead of == at PerpetualAtlanticVaultLP.subtractLoss
psytama (Dopex) confirmed via duplicate issue 619
