# Collateral can be claimed back without repaying its corresponding loan due to insufficient instruction validation

Lavarage's borrow_collateral only validated trader/pool on the repay_sol instruction, not the position account, letting a trader repay a dust position while withdrawing another position's collateral.

- Payout: Contest reward
- Severity: high
- Program: Lavarage
- Credited: Arabadzhiev
- Disclosed: 2024-05-29
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2024-04-lavarage-findings/issues/26
- Library page: https://bugbountylibrary.com/r/c4%3A2024-04-lavarage%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solana technique:chained technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** Solana Anchor program (swapback.rs borrow_collateral instruction validation)
**Root cause:** borrow_collateral validates the repay_sol instruction's trader and trading_pool but never checks that the repay instruction's position_account matches the position being closed, so a repay for a different (dust) position satisfies the check.
**Steps:**
1. Open position A with a tiny borrow (e.g. 5 lamports) and add collateral; repay it fully via tradingCloseRepaySol.
2. Open position B borrowing a meaningful amount (e.g. 50,000,000 lamports) and add collateral.
3. Build a close transaction for position B: tradingCloseBorrowCollateral(position B) followed by reusing the repay_sol instruction from position A.
4. borrow_collateral sees a valid repay_sol for the same trader/pool and releases position B's collateral without B's loan being repaid.
5. Repeat to drain the trading pool's SOL.
**How found:** Code review of the borrow_collateral instruction-validation logic in swapback.rs; noticed the checks compared trader and pool keys but not the position_account key of the repay_sol instruction, then built a stateful PoC reusing a prior repay instruction.
**Exploitation:** Attacker opens a dust loan, repays it, then reuses that repay_sol instruction when closing a large loan position; collateral is returned while the large loan remains unpaid, netting the borrowed SOL minus fees.
**Escalation:** Repeatable across positions to drain any trading pool's node wallet liquidity.
**Insight:** When a program validates a cross-instruction (CPI/introspection) dependency, check every account that binds the instruction to the current context—especially the position/state account—not just owner and pool; reusing a stale valid instruction is the classic bypass.