# Users can reduce self liquidation fees by manipulating the swap

Self-liquidation fee is computed from collateral actually swapped, so sandwiching the swap inflates collateral price and slashes the 8% fee.

- Payout: Contest reward
- Severity: medium
- Program: Jigsaw
- Credited: phil
- Disclosed: 2025-08-11
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_jigsaw_june2025.pdf#3.2.1
- Library page: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:liquidation vuln:oracle-manipulation

**Target:** LiquidationManager.selfLiquidate swap path
**Root cause:** Self-liquidation fee is charged on collateralUsedForSwap returned by swapExactOutputMultihop rather than on jUSD burned or oracle-priced collateral, so a manipulated swap price shrinks the fee base.
**Steps:**
1. User holds 1000 jUSD debt backed by collateral worth ~1000 USD.
2. Attacker/user front-runs the selfLiquidate swap to inflate collateral price (e.g. to 100000 USD equivalent).
3. Call `selfLiquidate()`; `swapExactOutputMultihop` returns a tiny `collateralUsedForSwap` (0.01 unit).
4. Fee computed as `collateralUsedForSwap.mulDiv(selfLiquidationFee, precision, Ceil)` = 0.0008 unit instead of 0.08.
5. Back-run to restore price; user keeps ~99% of the fee.
**How found:** Code review of selfLiquidate: noticed the fee is derived from the swap's collateral input rather than the jUSD debt, making the fee base manipulable by the same swap the user controls.
**Exploitation:** Self-sandwich the selfLiquidate swap: buy collateral before the call to raise its price, let selfLiquidate swap minimal collateral for the fixed jUSD burn amount, then sell collateral back after. Fee paid to feeAddress() drops proportionally to the price inflation.
**Insight:** When a fee is computed from the output of an AMM swap the caller controls, the fee base is attacker-movable; check whether fee/protocol accounting uses swap return values instead of oracle prices or the fixed debt amount.