# Pool value calculation skips accounting for stable token losses and short uPnL

Elfi pool value calc skips stable token loss and uPnL when amount and unsettledAmount are zero, mispricing ERC4626 shares after isolated short closes.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: ZeroTrust
- Disclosed: 2024-05-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/71
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-16
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** LpPoolQueryProcess.getPoolValue stable token loop
**Root cause:** The stable token loop only adds value when tokenBalance.amount or unsettledAmount is >0, but lossAmount and unPnl can be non-zero independently, so they are skipped when both are zero.
**Steps:**
1. Deposit WBTC as user0; set oracle WBTC=25k, USDC=1.
2. Open isolated SHORT BTC/USD 5x with 1000 USDC margin via createOrderRequest + executeOrder.
3. Move oracle WBTC to 22k; mine blocks to accrue fees.
4. Close position with LONG DECREASE order at 22k (position in loss, pool profit).
5. After close, tokenBalance.amount and unsettledAmount are 0 but lossAmount and unPnl non-zero; getPoolWithOracle returns poolValue that omits them.
6. Compare with cross margin where unsettled fee keeps amount>0 and loss is counted.
**How found:** Code reading of the pool value loop: noticed the guard `if (tokenBalance.amount > 0 || tokenBalance.unsettledAmount > 0)` can be false while lossAmount and unPnl are non-zero; hypothesized isolated position close in profit erases unsettled stable token leaving a loss; confirmed with a coded PoC comparing isolated vs cross margin.
**Exploitation:** Attacker opens and closes isolated short positions so that stable token amount and unsettledAmount become zero while lossAmount and uPnL remain non-zero, causing pool value to be misreported; then mints or redeems ERC4626 shares at the skewed value to extract value from other LPs.
**Insight:** In accounting loops, guards that gate on one field can silently skip other signed fields (loss, uPnL) that remain non-zero; check every term that contributes to the sum, especially after position close where unsettled amounts zero out.