# Users can bypass the maxWinPercent limit using a partially closing

Partial position closes in Tigris Trading compare maxWinPercent against full margin, letting traders repeatedly withdraw far more than the 500% PnL cap.

- Payout: Contest reward
- Severity: high
- Program: Tigris Trade
- Credited: hansfriese
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/507
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Trading.sol _closePosition payout cap
**Root cause:** The maxWinPercent cap compares the partial payout against the full trade margin instead of the proportional partial margin, so each partial close resets the cap against the whole margin.
**Steps:**
1. Open position with margin=100 and PnL=1000 after fees; maxWinPercent=500%.
2. Close 50%: `_toMint = 500`, compared to full margin 100*500% = 500, so no cap applied; receive 500.
3. Remaining margin=50, PnL=500; repeat partial close to extract again.
4. Repeat until nearly the full 1000 PnL is withdrawn despite a 500 cap.
**How found:** Code review of `_closePosition` noticed the cap compares `_toMint` (partial payout) against `_trade.margin` (full margin) rather than the partial margin, suggesting repeated partial closes could each pass the check.
**Exploitation:** Trader opens a high-PnL position then repeatedly partially closes it; each close pays out up to 500% of the full original margin because the cap uses `_trade.margin` rather than the proportional partial margin, draining LP funds beyond the intended max win.
**Insight:** When a cap or ratio check is applied to a partial-close/partial-withdraw path, verify the denominator is also scaled by the same percentage; mismatched scaling lets repeated partial operations each satisfy the check.