# Insurance slippage reimbursement can be used to steal insurance fund

Liquidation.claimReceipt accepted duplicate orders, letting a self-liquidating attacker inflate slippage reimbursement and drain the insurance fund.

- Payout: Audit contest
- Severity: high
- Program: Tracer
- Found by: cmichel
- Disclosed: 2021-09-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-06-tracer-findings/issues/105
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** Liquidation contract claimReceipt / calcUnitsSold
**Root cause:** claimReceipt's orders array is not checked for duplicates, so calcUnitsSold sums the same bad order repeatedly, inflating unitsSold to the full amountLiquidated and producing a bad avgPrice used for reimbursement.
**Steps:**
1. Attacker controls two accounts: liquidator and liquidatee.
2. Open high-leverage trades so liquidatee becomes liquidatable on next price update.
3. Liquidator liquidates liquidatee.
4. Submit one good trade at market price filling 99% of liquidation amount (no slippage).
5. Submit one bad trade at horrible price filling 1% of liquidation amount (slippage triggers).
6. Call `claimReceipt(orders)` with the bad order duplicated ~100 times.
7. calcUnitsSold returns unitsSold = receipt.amountLiquidated with bad avgPrice, reimbursing price difference on full amount.
**How found:** Code review of claimReceipt/calcUnitsSold: noticed the orders array is iterated without deduplication, so the same receipt can be counted multiple times.
**Exploitation:** Self-liquidation with a controlled liquidator; a tiny bad trade is duplicated in the orders array so slippage reimbursement is paid on the full liquidation amount rather than 1%, yielding profit. Repeat until insurance fund drained.
**Escalation:** Repeat the cycle across price updates to drain the entire insurance fund.
**Insight:** When a function accepts an array of user-supplied items that are aggregated (summed/averaged), check whether duplicates are possible; aggregation over a caller-controlled list is a classic inflation vector.