# Users can use weth to replace any margin token in createUpdatePositionMarginRequest()

Elfi's createUpdatePositionMarginRequest lets users deposit WETH while specifying a different margin token, draining that token from the Trade Vault and blocking other users' requests.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: jennifer37
- Disclosed: 2024-05-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/79
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-19
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** PositionFacet.createUpdatePositionMarginRequest / PositionMarginProcess
**Root cause:** createUpdatePositionMarginRequest uses params.marginToken as request.marginToken without validating that it matches the wrapper token when params.isNativeToken is true, so the deposited WETH is credited as an arbitrary margin token.
**Steps:**
1. User0 opens a Long BTC position with wBTC margin.
2. User1 opens a Long BTC position with wBTC margin.
3. User0 calls `createUpdatePositionMarginRequest({positionKey, isAdd:true, isNativeToken:true, marginToken:wbtc, updateMarginAmount:0.1e18, executionFee}, {value:0.1e18})` depositing WETH but recording wBTC as margin token.
4. User1 calls `createUpdatePositionMarginRequest` with `isNativeToken:false, marginToken:wbtc` depositing 0.1 wBTC.
5. Keeper calls `executeUpdatePositionMarginRequest(requestId, oracle)` for User0's request; `VaultProcess.transferOut` sends 0.1 wBTC from Trade Vault to LP Pool.
6. If Trade Vault lacks enough wBTC, User1's request cannot execute and may not be cancellable.
**How found:** Manual review of createUpdatePositionMarginRequest noticed that params.marginToken is stored directly in the request without checking consistency with params.isNativeToken, then traced execution to see the vault transfers the stored margin token.
**Exploitation:** Attacker deposits WETH via isNativeToken=true while setting marginToken to a valuable token like wBTC. When the keeper executes the request, the protocol transfers the specified margin token from the Trade Vault to the LP Pool, effectively converting WETH into the target token at the protocol's expense. Repeated or large requests can drain the Trade Vault's balance of that token, blocking other users' legitimate margin updates.
**Escalation:** Can be repeated to drain the Trade Vault of a target token and cause denial of service for other users' margin requests.
**Insight:** When a function accepts both a native-token flag and an explicit token address, verify they are consistent; otherwise the deposited asset and the credited asset can diverge, letting attackers mint value from the vault.