# Submitting mint request using user's trading balance and cancelling it will not refund tokens back to trading account

Elfi's cancelMintStakeToken only refunds wallet-funded amounts, so users who minted using trading-account balance lose those tokens on cancellation.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: eeshenggoh
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/77
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-18
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic

**Target:** MintProcess.cancelMintStakeToken in elfi-perp-contracts
**Root cause:** cancelMintStakeToken refunds only walletRequestTokenAmount to the EOA and never credits back the portion of requestTokenAmount pulled from the trading account via _transferFromAccount.
**Steps:**
1. Submit a mint request where requestTokenAmount > walletRequestTokenAmount, so the difference is debited from the trading account via _transferFromAccount.
2. Keeper fails to execute; keeper calls cancelMintStakeToken for the requestId.
3. Observe only walletRequestTokenAmount is transferred out to the user; the trading-account portion is never returned or credited.
**How found:** Code reading of _mintStakeToken's _transferFromAccount branch versus cancelMintStakeToken's refund logic, noticing the cancel path only handles walletRequestTokenAmount.
**Exploitation:** Any user whose mint request is cancelled after funding part of it from trading balance permanently loses that portion; no attacker action needed beyond normal mint+cancel flow.
**Insight:** When a deposit path has two funding sources (wallet vs internal balance), audit every refund/cancel path for symmetric handling of each source; the cancel branch often mirrors only the EOA transfer.