# Leverage Increase Breaks Margin Removal Invariant

setPositionLeverage() in GTE perps lacks removeMargin()'s post-withdrawal margin check, letting users raise leverage to extract margin from profitable positions.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: BenRai
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** perps/PerpManager.sol setPositionLeverage()
**Root cause:** setPositionLeverage() validates only against assertOpenMarginRequired() (minOpenMargin based on market maxOpenLeverage), while removeMargin() enforces assertPostWithdrawalMarginRequired() with intendedMargin.max(totalNotional/10). The stricter check is absent on leverage increase.
**Steps:**
1. Open a position with margin and unrealized profit.
2. Call `setPositionLeverage()` to increase leverage; intendedMargin = currentNotional / newLeverage decreases.
3. settleNewLeverage() adjusts margin balance down to the new intendedMargin, releasing margin.
4. Observe the released margin would have been blocked by `removeMargin()`'s assertPostWithdrawalMarginRequired() check.
**How found:** Code review comparing the two margin-validation paths: noticed removeMargin() uses assertPostWithdrawalMarginRequired() with intendedMargin.max(totalNotional/10) while setPositionLeverage() only uses assertOpenMarginRequired() based on market maxOpenLeverage, then traced how intendedMargin shrinks as leverage rises.
**Exploitation:** User raises leverage on a profitable position; settleNewLeverage() reduces margin to the lower intendedMargin, extracting collateral that removeMargin() would have rejected, leaving the position undercollateralized relative to the intended safety invariant.
**Insight:** When a protocol has two paths that both reduce collateral (explicit withdraw vs. leverage change), diff their validation functions; a leverage-increase path that recomputes intendedMargin = notional/leverage can silently release margin bypassing the withdraw guard.