# Certain fee configuration enables vaults to be drained

Attacker-supplied take-profit price overflows unchecked math in TradingLibrary.pnl(), minting 10^36 Tigris tokens to drain vaults under a specific fee config.

- Payout: Contest reward
- Severity: high
- Program: Tigris Trade
- Credited: Bobface
- Disclosed: 2023-02-17
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/86
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-03
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Trading/TradingLibrary.pnl() and _handleCloseFees() in Tigris perpetuals contracts
**Root cause:** TradingLibrary.pnl() computes position size and payout inside an unchecked block using the user-supplied take-profit price as _currentPrice; a crafted value makes `1e18*_currentPrice/_price - 1e18` equal 0 (payout = margin) while `_initPositionSize*_currentPrice` yields a huge _positionSize without reverting.
**Steps:**
1. Set fees via `setFees(false, 200000000, 0, 100000000, 0, 0)` so daoFees ≈ 2*referralFees.
2. Create own referral code and set self as referrer.
3. Call `initiateLimitOrder` with margin 1e18, leverage 2, short, take-profit `115792089237316195423570985008687907854269984665640564039467`.
4. Advance time, sign priceData, call `executeLimitOrder(1, priceData, sig)`.
5. Advance time, call `limitClose(1, true, priceData, sig)`; observe >10^36 Tigris minted.
6. Deposit minted Tigris into vault and withdraw assets.
**How found:** Code-reading of TradingLibrary.pnl()'s unchecked arithmetic combined with noticing the take-profit price is fully user-controlled and flows into _handleCloseFees; hand-calculated the exact take-profit value to make payout zero while overflowing position size, and identified the daoFees=2*referralFees configuration needed to avoid the revert at line 805.
**Exploitation:** Attacker opens and closes a limit order with a hand-crafted take-profit price that overflows the unchecked pnl math, causing _handleCloseFees to mint a massive referral fee (daoFees near zero due to the 2:1 fee ratio), then redeems the minted Tigris tokens against the vault for stable assets.
**Insight:** In perp/DEX code, user-supplied trigger prices (take-profit/stop-loss) flowing into unchecked PnL math are prime overflow targets; look for fee formulas where one fee term is excluded from a later subtraction so a huge position size mints tokens without reverting.