# redeem stake token may be Dos because there is not enough balance in stake pool.

Elfi staking routes MINT_COLLATERAL deposits to portfolio vault but redeems from LP vault, letting one staker drain LP vault and DoS other LPs' redemptions.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: CL001
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/57
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-11
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** StakeFacet / AssetsProcess.depositToVault on EVM perp contracts
**Root cause:** createMintStakeTokenRequest routes deposits to portfolio vault when isCollateral=true but to LP vault when false; redemption always pulls from LP vault, so LP vault balance can be insufficient.
**Steps:**
1. user0 calls createMintStakeTokenRequest with isCollateral=true, 300 WETH -> funds go to portfolio vault, stake tokens minted
2. user1 calls createMintStakeTokenRequest with isCollateral=false, 300 WETH -> funds go to LP vault
3. user1 calls handleRedeem for ~299 stake tokens -> LP vault pays out, draining it
4. user0 calls handleRedeem for 200 stake tokens -> reverts due to insufficient LP vault balance
**How found:** Code reading of depositToVault routing: noticed MINT_COLLATERAL and MINT send funds to different vaults while redeem only draws from LP vault, then wrote a two-user Foundry/Hardhat test to confirm the revert.
**Exploitation:** Attacker stakes via isCollateral=true so their capital lands in portfolio vault while still receiving stake shares; then redeems from LP vault, draining the LP vault funded by honest MINT stakers and blocking their redemptions.
**Insight:** When a protocol has multiple deposit entrypoints that route funds to different vaults, check that every exit path (redeem/withdraw) draws from the vault matching each entrypoint; mismatched routing lets one class of depositor drain another's backing.