# Bypass the delay security check to win risk free funds

Tigris Trade's delay check only blocks same-tx open/close, so opening a long and short at two different signed prices in one tx locks risk-free profit from LPs.

- Payout: Contest reward
- Severity: medium
- Program: Tigris Trade
- Credited: KingNFT
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/108
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Trading contract / signed oracle price pool
**Root cause:** _checkDelay() only prevents opening and closing in the same tx, but does not prevent opening two opposing positions (long and short) in the same tx using two different valid signed prices from the pool.
**Steps:**
1. Obtain two valid node-signed price payloads for the same asset at different prices (e.g. 1000 and 1010) within the signature validity window.
2. Call `initiateMarketOrder` with TradeInfo long=true at price 1000 and the corresponding signed PriceData.
3. In the same tx call `initiateMarketOrder` with TradeInfo long=false at price 1010 and its signed PriceData.
4. Later, close both positions using a favorable signed close price (e.g. 1050) via `initiateCloseOrder` for each id.
5. Profit = spread × leverage minus fees; repeat with a second price pair (1050/1040) to double profit.
**How found:** Reading the _checkDelay() logic and noticing it only guards open-then-close in the same tx, not two opposing opens; hypothesized that two valid signed prices in the pool could be used simultaneously for a risk-free long/short pair.
**Exploitation:** Attacker opens a leveraged long at the lower signed price and a leveraged short at the higher signed price in one transaction, bypassing the delay guard. On close, both legs are settled at a favorable price, extracting the price spread magnified by leverage from the LP pool with no directional risk.
**Escalation:** Using two distinct close-price pairs (1050 and 1040) doubles the extracted profit; scaling leverage increases the spread capture.
**Insight:** When a protocol guards 'same-tx open and close' to stop price arbitrage, check whether two opposing opens (long+short) at different signed prices in the same tx achieve the same risk-free spread capture; the guard must also constrain which price each side may use.