# Loss of user funds, as LeverageMacroReferences can't do an arbitrary system call to the function claimsSurplusCollShare in order to claim the extra surplus collateral gained from their liquidated or fully redeemed Cdps

LeverageMacroReference blocks arbitrary calls to system contracts, so surplus collateral from fully redeemed or liquidated Cdps is permanently stuck in CollSurplusPool.

- Payout: Contest reward
- Severity: high
- Program: eBTC Protocol
- Credited: Stormy
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-badger-findings/issues/323
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-badger%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:liquidation

**Target:** LeverageMacroReference / BorrowerOperations.claimSurplusCollShares
**Root cause:** LeverageMacroReference has no built-in claim-surplus operation, and _ensureNotSystem blocks arbitrary calls to borrowerOperations, the only entry point to CollSurplusPool.
**Steps:**
1. Deploy LeverageMacroReference via deployNewMacro(wallet).
2. Call doOperation twice with OpenCdpOperation to open two Cdps owned by the macro.
3. Fully redeem one Cdp via cdpManager.redeemCollateral(debt, cdpId, ...).
4. Confirm collSurplusPool.getSurplusCollShares(macro) > 0.
5. Build SwapOperation with addressForSwap=borrowerOperations and calldata `claimSurplusCollShares()`.
6. Call _doSwap -> _ensureNotSystem reverts on `require(addy != address(borrowerOperations))`.
**How found:** Code reading of _doSwap/_ensureNotSystem against the only claim path (borrowerOperations.claimSurplusCollShares), then PoC confirming the revert after a full redemption leaves surplus.
**Exploitation:** No attacker path; the macro owner simply cannot recover surplus collateral, which remains locked in CollSurplusPool indefinitely.
**Insight:** When a router/macro contract whitelists call targets, check every legitimate value-extraction path (surplus claims, refunds, reward claims) that requires calling a blocked system contract; ownership of a position by the macro makes any such path unreachable.