Submitted by hansfriese, also found by 0x52, 0xA5DF, and bin2chen
Users can bypass the maxWinPercent limit using a partial closing.
As a result, users can receive more funds than their upper limit from the protocol.
As we can see from the documentation, there is limitation of a maximum PnL.
And this logic was implemented like below in _closePosition().
But it checks the maxWinPercent between the partial payout and full margin so the below scenario is possible.
We should check the maxWinPercent between the partial payout and partial margin like below.
TriHaz (Tigris Trade) confirmed, but disagreed with severity and commented:
Alex the Entreprenerd (judge) commented:
GainsGoblin (Tigris Trade) resolved:
