# exitPosition in TapiocaOptionBroker may incorrectly inflate position weights

exitPosition in TapiocaOptionBroker subtracts current pool.AverageMagnitude instead of the exiting user's stored weight, corrupting pool.cumulative and inflating remaining participants' voting power.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: ItsNio
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1623
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TapiocaOptionBroker.exitPosition / twAML pool accounting
**Root cause:** exitPosition() updates pool.cumulative using the current pool.AverageMagnitude rather than the exiting participant's own recorded magnitude, so a large-weight participant's magnitude is subtracted when a small-weight user exits.
**Steps:**
1. Deploy tOB/tOLP, register singularity, deposit into YieldBox, lock two positions A (short, small) and B (long, large).
2. A calls `participate(tokenID_A)` -> pool.cumulative = 10, AverageMagnitude = 10.
3. Advance time; B calls `participate(tokenID_B)` -> pool.cumulative = 60, AverageMagnitude = 50.
4. Advance past A's expiry; A calls `exitPosition(oTAP_A)` -> pool.cumulative drops by 50 (AverageMagnitude) instead of 10, leaving cumulative = 10.
5. Observe remaining B's weight (50) exceeds pool.cumulative (10), giving divergent/inflated power to subsequent participants.
**How found:** Code review of exitPosition's update to pool.cumulative on line 316 noticed it used pool.AverageMagnitude instead of the user's stored magnitude; constructed a multi-user scenario and Foundry test to confirm the disproportionate subtraction.
**Exploitation:** Attacker participates with a small weight, waits for a large-weight participant to join, then exits; the large magnitude is subtracted from pool.cumulative, leaving the pool's cumulative far below actual weights so a new participant's weight dominates the twAML accounting.
**Insight:** In twAML-style cumulative accounting, always verify that exit/withdraw paths subtract the exact per-user stored magnitude, not a pool-level average that may have been overwritten by later larger participants.