# Due to logical error when changing leverage the system also refunds the margin that should be backing the unrealized loss the account holds.

Changing leverage on an open perp position refunds margin backing unrealized losses, letting traders withdraw funds and stick the insurance fund with bad debt.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: Stormy
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-01
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** perps PerpManager / CollateralManager leverage-change flow
**Root cause:** settleNewLeverage computes collateralDelta from newMargin minus currentMargin without accounting for negative uPnL, so margin effectively covering unrealized loss is refunded.
**Steps:**
1. Open a 20k long position at 1x leverage (20k margin).
2. Market moves against position producing -10k uPnL.
3. Call leverage-change so getIntendedMargin returns 5k new margin.
4. settleNewLeverage sets margin to 5k and refunds 20k-5k=15k instead of (20k-10k)-5k=5k.
5. Withdraw refunded margin; position now undercollateralized, loss becomes bad debt covered by insurance fund.
**How found:** Code review of the leverage-change path: noticed settleNewLeverage ignores uPnL while assertOpenMarginRequired checks equity (margin+upnl), revealing the refund calculation mismatch.
**Exploitation:** Trader opens leveraged position, waits for negative uPnL, then changes leverage to trigger an oversized margin refund, withdrawing margin that should back the loss and leaving bad debt to the protocol.
**Insight:** When a margin/equity check uses margin+uPnL but the settlement function only moves raw margin, the delta between the two is refundable — compare every check's accounting basis against the state-mutation function's basis.