# Self-trade slippage reimbursement drain

Permissionless trade plus unverified slippage reimbursement or self-matching that pays out escrow

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2023-04-16. Updated 2026-10-25._

## How it works
A protocol pays someone back for a loss (slippage, liquidation escrow, funding) but never checks that the loss was real. The assumption that breaks: that a trade producing a reimbursable loss was between independent parties. When trade execution is permissionless and the reimbursement path does not verify who controlled each side, the same actor can be both buyer and seller, manufacture the loss, and collect the payout. The protocol's own funds or LP capital fund the drain.

## Where it shows up
- A reimbursement or escrow-claim function that pays out slippage or losses without checking trade legitimacy [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AM-11.md)
- Permissionless trade entry points where the caller can set both counterparties [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AM-11.md)
- Privileged order-matching roles that choose their own counterparties, including self-matching liquidations at worse prices [E1](https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-3.md)
- TWAP or mark-price observation that a privileged role can nudge within allowed spread bounds [E1](https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-3.md)
- Guards that only block one shape of abuse (same-tx open/close) but not adjacent shapes (two opposing opens) [E2](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-03.md)

## How to review
For every payout path, ask: can the claimant control both sides of the event that generated the loss? The invariant: a reimbursable loss must arise from a trade where the claimant did not choose or own the counterparty, and the price must come from a source the claimant cannot influence. Check that matching privileges cannot self-match user flow, that TWAP inputs cannot be skewed by the privileged role within spread limits, and that delay or anti-arbitrage checks cover all combinations (open+close, long+short, multiple signed prices), not just one [E2](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-03.md).

## Variants seen
- Self-trade between two owned accounts to generate slippage, then claim escrow reimbursement [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AM-11.md)
- Validator self-matches liquidations at worse prices and skews markPriceTwap to manipulate funding [E1](https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-3.md)
- Two opposing opens at different signed prices in one tx to lock risk-free profit from LPs [E2](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-03.md)

## Impact and severity
Direct loss of protocol or LP funds, risk-free to the attacker. Severity rises when the payout is automatic and the trade path is open to anyone [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AM-11.md), and when a privileged role has exclusive matching with no slashing or fairness enforcement [E1](https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-3.md). Partial guards that miss adjacent shapes widen exposure [E2](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-03.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-3.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AM-11.md