# Closing positions does not decrease the pool's entry price, leading to misleading pool value calculations

Elfi perp pool entry price is updated on position increase but not decrease, so pool value is mispriced, letting LP minters/redeemers gain unfairly.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/58
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-12
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Perp DEX LP pool value / entry price accounting (LpPoolQueryProcess, MarketProcess)
**Root cause:** _addOI recomputes the pool's average entry price when open interest increases, but _subOI only reduces openInterest and never adjusts entryPrice, so the pool's unrealized PnL and value stay stale after closes.
**Steps:**
1. Open LONG position user0 at oracle price 25000 (1 BTC, 10x).
2. Open LONG position user1 at oracle price 50000.
3. Close user0's position in profit at price 50000; entryPrice remains the weighted average, not reduced.
4. Close user1's position at price 50000; openInterest hits 0 and entryPrice resets to 0, realizing all pool profit at once.
5. Observe poolValue via poolFacet.getPoolWithOracle: 4690291...e24 before second close, 4772375...e24 after — value spikes upward.
6. Mint/redeem LP shares during the mispriced window to capture unfair value.
**How found:** Code reading of _addOI vs _subOI in MarketProcess: noticed entryPrice is recomputed via computeAvgEntryPrice only on increase, then reasoned through a two-position scenario showing pool value mispricing and confirmed with a Foundry test logging poolValue before/after closes.
**Exploitation:** Attacker monitors pool state and mints LP stake tokens while pool value is understated (entry price stale-low), then redeems after the second position closes and entryPrice resets to 0, capturing the value spike; or redeems before the spike to avoid losses.
**Insight:** In perp/LP accounting, check that every state variable updated on position increase (entry price, open interest, funding) is symmetrically updated on decrease; asymmetric updates leave stale averages that misprice share mint/redeem.