Message: ExecuteMsg.RemoveMargin
This message can be sent via a CosmosWasm contract and allows for a collateral to be removed from an existing position. The parameters that a user can control are
Sender
— This is the account holding the position; there are no checks (see ).Pair
— This is the pair of the position to remove margin from. It is checked to ensure that it is valid and that there is an open position, a market, and an AMM for the pair.Margin
— This is the amount of collateral to remove from the position; there are no checks on the amount.
After the sdkMsg
is created, there is no call to ValidateBasic
(which automatically happens for regular Cosmos transactions), so a lot of vital checks (such as negative numbers) are missed. In this case, a negative margin can be specified when it ends up being added to the position margin without transferring any funds from the user; see the related finding at .
The flow is then the same as the regular AddMargin
transaction; see .