# User can abuse tight stop losses and high leverage to make risk free trades

Tigris closes stop-loss positions at the user-specified SL price instead of market price, letting traders cap downside and take asymmetric risk-free leveraged bets at LP expense.

- Payout: Contest reward
- Severity: high
- Program: Tigris Trade
- Credited: 0x52
- Disclosed: 2023-02-17
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/622
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Perpetual trading limitClose / _limitClose stop-loss execution
**Root cause:** _limitClose uses the stored slPrice as the execution price rather than only as a trigger, so positions close at the user's chosen SL price regardless of the actual market price.
**Steps:**
1. Open a high-leverage long position with slPrice set $0.01 below current price.
2. Wait for next price update; if price tanks, call `limitClose(_id, false, _priceData, _signature)` and position closes at slPrice, capping loss to fees.
3. If price rises, close at profit; downside is bounded by the stored SL price, not market.
**How found:** Code review of _limitClose revealed the @audit note that stop loss closes at the user-specified price rather than current market price, prompting the risk-free trade hypothesis.
**Exploitation:** Trader opens high-leverage directional position with a tight stop loss just below entry. On adverse price movement the position is closed at the stored SL price rather than the worse market price, capping loss to open/close fees and spread while retaining full upside on favorable moves, transferring risk to LPs.
**Insight:** When a stop-loss/take-profit is used as a trigger, verify the fill price is the current oracle price, not the stored trigger value; otherwise the trigger doubles as a guaranteed execution price capping user risk.