# PaprController.buyAndReduceDebt: msg.sender can lose paper by paying the debt twice

PaprController.buyAndReduceDebt sends swapped papr to account but burns papr from msg.sender, so caller pays debt twice.

- Payout: Contest reward
- Severity: medium
- Program: Backed Protocol
- Credited: HollaDieWaldfee
- Disclosed: 2023-01-31
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-backed-findings/issues/187
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-backed%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PaprController.buyAndReduceDebt / UniswapHelpers.swap
**Root cause:** UniswapHelpers.swap recipient is set to `account` while _reduceDebt burns papr from `msg.sender`, so the swapped output and the burned repayment come from different parties.
**Steps:**
1. Call `buyAndReduceDebt(account, collateralAsset, params)` where account != msg.sender.
2. swap sends amountOut papr to `account` (recipient param).
3. `_reduceDebt({account, burnFrom: msg.sender, amount: amountOut})` burns amountOut papr from msg.sender.
4. msg.sender pays underlying for swap AND loses papr burned; account receives papr and debt reduction.
**How found:** Code reading of buyAndReduceDebt: noticed swap recipient is `account` but burnFrom is `msg.sender`, an inconsistency between who receives and who pays.
**Exploitation:** Caller with sufficient papr balance invokes buyAndReduceDebt for another account; their papr is burned to repay that account's debt while the swapped papr also lands in the account, doubling the caller's cost.
**Insight:** In swap-and-repay helpers, verify the swap recipient matches the burnFrom address; mismatched recipient/payer params silently double-charge the caller.