# multiHopSellCollateral() will fail due to call on an invalid market address causing bridged collateral to be locked up

multiHopSellCollateral calls getBorrowPartForAmount on a market that only exists on the host chain, reverting cross-chain leverage-down and locking bridged collateral.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: peakbolt
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1202
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-18
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** Singularity/SGLLeverage and BaseTOFTLeverageModule cross-chain leverage-down
**Root cause:** leverageDownInternal on the destination (non-host) chain calls IMagnetar.getBorrowPartForAmount with externalData.srcMarket, but Singularity/BigBang markets are only deployed on the host chain (Arbitrum), so the call reverts.
**Steps:**
1. User calls `Singularity.multiHopSellCollateral()` on Arbitrum (host chain).
2. SGLLeverage.multiHopSellCollateral sends cross-chain message via `ITapiocaOFT(collateral).sendForLeverage()` to bridge collateral to Ethereum.
3. Ethereum TOFT receives via `_nonBlockingLzReceive()` then `BaseTOFTLeverageModule.leverageDown()`.
4. `leverageDownInternal()` swaps to USDO then calls `IMagnetar(externalData.magnetar).getBorrowPartForAmount(externalData.srcMarket, amountOut)` on a non-existent market and reverts.
5. Refund mechanism also reverts and `retryMessage()` keeps failing, locking bridged collateral in the TOFT contract.
**How found:** Code reading of the cross-chain leverage-down flow: noticed leverageDownInternal queries market state (getBorrowPartForAmount) on the destination chain, while markets are only deployed on the host chain, making the call permanently invalid.
**Exploitation:** Not an attacker-driven exploit; a functional bug. Any user invoking multiHopSellCollateral to leverage down on a non-host chain triggers a permanent revert, stranding their bridged collateral in the destination TOFT contract with no successful refund path.
**Insight:** In cross-chain designs, check every state read in the destination-chain handler against where that state actually lives; market/accounting lookups belong on the host chain, and a permanent revert in a non-blocking LZ receive path also breaks refund/retry, locking funds.