# Not enough margin pulled or burned from user when adding to a position

Tigris Trading.addToPosition pulls _addMargin minus _fee from user, but fees are minted separately, letting traders add leverage without paying full margin.

- Payout: Contest reward
- Severity: high
- Program: Tigris Trade
- Credited: minhtrng
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/659
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** Trading.addToPosition / _handleDeposit margin accounting
**Root cause:** addToPosition passes _addMargin - _fee to _handleDeposit, but _handleOpenFees already mints the fee portion to referrer/protocol, so the user is charged less margin than accounted for.
**Steps:**
1. Call Trading.addToPosition with _addMargin and leverage.
2. Observe _fee = _handleOpenFees(asset, _addMargin*leverage/1e18, ...) mints fee tokens to referrer/msg.sender/protocol.
3. Observe _handleDeposit receives _addMargin - _fee, pulling/burning less than the user's stated margin.
4. Compare with initiateMarketOrder which passes full _tradeInfo.margin to _handleDeposit.
5. Result: position opened with more leverage than intended, leaking value from protocol.
**How found:** Code reading comparing addToPosition's _handleDeposit call against initiateMarketOrder's correct usage, spotting the inconsistent subtraction of _fee.
**Exploitation:** Trader repeatedly adds to positions paying only _addMargin - _fee while fee tokens are minted, achieving higher effective leverage than the protocol's collateralization invariant allows.
**Escalation:** Judge noted lack of checks allows more leverage than intended, breaking invariants and bypassing fees used as abuse defense.
**Insight:** When a fee is minted rather than transferred, check whether the deposit path also subtracts that fee — double-counting the fee against the user's margin silently inflates leverage.