# MarginTradingHook users could potentially be DOSed

MarginTradingHook's refundNative modifier force-sends unwrapped native to msg.sender; dust WNATIVE donations make calls revert for contracts lacking receive, griefing them.

- Payout: Contest reward
- Severity: medium
- Program: INIT Capital
- Credited: sashik\_eth
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-init-capital-invitational-findings/issues/35
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-init-capital-invitational%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** MarginTradingHook Solidity contract modifier
**Root cause:** refundNative unconditionally unwraps the contract's entire WNATIVE balance and force-sends native to msg.sender with a require(success), even when the caller never dealt in native and cannot receive it.
**Steps:**
1. Alice deploys a caller contract with no receive/payable fallback, using MarginTradingHook for ERC20-only trading.
2. Bob sends 1 wei WNATIVE to MarginTradingHook.
3. Alice calls any MarginTradingHook function with refundNative; modifier unwraps WNATIVE and calls payable(msg.sender).call{value:1}('').
4. Alice's contract rejects native, success=false, _require reverts the whole tx.
5. Bob repeats dust sends each block to sustain the DOS.
**How found:** Code-reading of the refundNative modifier: noticed it refunds the contract's full WNATIVE balance regardless of whether the call involved native, and that the require(success) turns a stray balance into a revert for non-payable callers.
**Exploitation:** Attacker spams 1-wei WNATIVE transfers to the hook each block; every refundNative call from a non-payable integrator contract reverts, blocking their trading and risking losses on open positions as markets move.
**Insight:** When a contract refunds its entire token balance to msg.sender rather than a tracked per-call amount, any external dust donation becomes attacker-controlled input to the caller's fallback; check whether the refund path can be griefed by forcing value onto a caller that rejects it.