# User can close an order via limitClose(), and take bot fees to themselves

Trader uses a proxy contract to update stop-loss and call limitClose() atomically, capturing the bot fee that would otherwise go to a bot, reducing DAO fees.

- Payout: Contest reward
- Severity: medium
- Program: Tigris Trade
- Credited: 0xA5DF
- Disclosed: 2023-02-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tigris-findings/issues/468
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:fee-bypass

**Target:** Tigris Trading contract limitClose/updateTpSl
**Root cause:** Bot fee is subtracted from DAO fee and paid to whoever executes limitClose(); a user can atomically set the limit and close in one tx via a proxy, so no bot can front-run and the user collects the bot fee.
**Steps:**
1. Open a position via initiateMarketOrder.
2. Deploy a proxy contract that calls trading.updateTpSl(false, id, price, priceData, sig, msg.sender) then trading.limitClose(id, false, priceData, sig) in one function.
3. Call trading.approveProxy(proxy, 1e10).
4. Invoke proxy.closeTrade(id, priceData, sig) so the limit is set and closed atomically, capturing the bot fee.
**How found:** Observed that bot fees are deducted from DAO fees and paid to the closing executor; reasoned that combining updateTpSl and limitClose in one call prevents any bot from racing, letting the user be the executor.
**Exploitation:** User deploys MyTrader proxy, approves it, and calls closeTrade which sets the stop-loss to the current price and immediately limitCloses in the same transaction, so no bot can execute limitClose() first; the bot fee is credited to the user instead of a bot, reducing DAO fee revenue.
**Insight:** When a protocol pays a fee to whoever executes a permissionless action, check whether a user can bundle the state-change and execution atomically via a proxy to become the executor and capture the incentive.