# Bypass the maximum PnL check to take extra profit

Tigris Trade's addToPosition() lacked the 500% max PnL check, letting traders bypass the profit cap and extract extra funds from the vault.

- Payout: Contest reward
- Severity: high
- Program: Tigris Trade
- Credited: KingNFT
- Disclosed: 2023-02-17
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/111
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic

**Target:** Trading contract addToPosition function
**Root cause:** The maximum PnL check (500%) enforced in close orders was not applied in addToPosition(), allowing positions to exceed the cap before closing.
**Steps:**
1. Open a leveraged position with margin $990 and 10x leverage at price $1000.
2. Price doubles to $2000, unrealized profit = $9900 (1000% PnL).
3. Call `addToPosition(orderId, extraMargin=1000e18, closePriceData, closeSig, ...)` to increase position size without triggering the PnL cap.
4. Close the position normally; payout exceeds the capped amount, yielding >$2600 extra profit.
**How found:** Auditor noticed the max PnL check was only in close order logic, not in addToPosition, and hypothesized it could be bypassed by adding to a profitable position before closing.
**Exploitation:** Attacker waits for a favorable price movement exceeding 500% PnL, then calls addToPosition to increase margin, bypassing the cap, and closes to receive uncapped profit from the vault.
**Insight:** When a protocol enforces a cap on profit or loss, check all functions that modify position size or margin (addToPosition, addMargin, removeMargin) for the same validation; missing checks in auxiliary functions are a common bypass.