# OstiumTrading::topUpCollateral() is missing pairsStored.groupMaxCollateral(pairIndex) check Medium · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-M03 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description When opening trades it is checked if the collateral is within limits for each pair in [OstiumTradingCallbacks::withinExposureLimits()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTradingCallbacks.sol#L513). The same should be done in [OstiumTrading::topUpCollateral()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTrading.sol#L388). ### Recommendation Add the check to OstiumTrading::topUpCollateral(). ### Status Addressed. --- Related findings: - [Index underflow is not protected against, although it has no impact as the pool with index type(uint256).max should not be registered](https://0xsimao.com/findings/nftperp-ii-index-underflow-impact-registered): Nftperp Matching Engine - [`borrowing::liquidate()` sends the wrong liquidation index to the destination chain, overwritting liquidation information and getting collateral stuck](https://0xsimao.com/findings/autonomint-liquidate-liquidation-index-stuck): Autonomint - [Drained lender due to `LenderCommitmentGroup_Smart::acceptFundsForAcceptBid()` `_collateralAmount` by `STANDARD_EXPANSION_FACTOR` multiplication](https://0xsimao.com/findings/teller-finance-bid-collateral-factor-multiplication): Teller Finance - [`FlashRolloverLoan_G5` will fail for `LenderCommitmentGroup_Smart` due to `CollateralManager` pulling collateral from `FlashRolloverLoan_G5`](https://0xsimao.com/findings/teller-finance-flash-rollover-collateral-pulling): Teller Finance