# A borrower can borrow SOL without backing it by a collateral

Lavarage borrow validated only that an addCollateral instruction existed, not that it targeted the same position, letting a borrower open two positions, collateralize one, and drain SOL from the other.

- Payout: Contest reward
- Severity: high
- Program: Lavarage
- Credited: Koolex
- Disclosed: 2024-05-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-04-lavarage-findings/issues/16
- Library page: https://bugbountylibrary.com/r/c4%3A2024-04-lavarage%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solana technique:chained technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** Solana Anchor program: tradingOpenBorrow / tradingOpenAddCollateral / tradingCloseRepaySol
**Root cause:** The borrow instruction checks that a TradingOpenAddCollateral instruction is present in the same transaction but never verifies that the collateral instruction's position account matches the borrowing position, so collateral can be attributed to a different position.
**Steps:**
1. Open Pos#1 and Pos#2 in one transaction via `tradingOpenBorrow`.
2. Send `tradingOpenAddCollateral` for both collateral transfers but set `positionAccount` to Pos#1 in both instructions.
3. Pos#2 now has zero collateral but its borrowed SOL was disbursed.
4. Call `tradingCloseBorrowCollateral` + `tradingCloseRepaySol` on Pos#1 only, repaying Pos#1's debt and withdrawing all collateral.
5. Pos#2's borrowed SOL remains unpaid with no collateral backing it.
**How found:** Code review of the borrow instruction's validation: noticed it only asserts the presence of an addCollateral instruction in the transaction rather than matching the position account, then constructed a two-position single-transaction PoC to confirm.
**Exploitation:** Borrower bundles two borrows and two addCollateral instructions in a single transaction, pointing both addCollateral calls at Pos#1. After both borrows disburse SOL, the borrower repays only Pos#1, which releases the full collateral, leaving Pos#2's loan unbacked and the lender short by Pos#2.borrowed.
**Insight:** When a program validates a companion instruction by presence (e.g. via sysvar instructions) rather than by matching account keys, check whether the companion's accounts can be pointed at a different position/state object than the one being acted on.