# Anyone can change the balance of an account to drain the entire portfolio vault

Unauthenticated batchUpdateAccountToken in Elfi AccountFacet let anyone set arbitrary token balances in the portfolio vault, enabling full drain.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: 0xPwnd
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/28
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** AccountFacet.batchUpdateAccountToken on Elfi perp contracts
**Root cause:** batchUpdateAccountToken writes arbitrary changedTokenAmounts into account token balances with no access control and no corresponding token transfer, so any caller can inflate their own balance.
**Steps:**
1. Deposit a small amount (e.g. 1000 USDC) so the caller's account exists.
2. Call `accountFacet.batchUpdateAccountToken({account: user0.address, tokens: [usdcAddr, wbtcAddr], changedTokenAmounts: [100_000e6, 100e18]})` from user0.
3. Read `getAccountInfo(user0.address)` to confirm the forged balances.
4. Withdraw the inflated balances from the portfolio vault.
**How found:** Manual review of AccountFacet surfaced a state-mutating function with no access control and no token transfer, suggesting it was a test-only helper left exposed.
**Exploitation:** Attacker calls batchUpdateAccountToken to set arbitrary token balances for their own account, then withdraws the fabricated amounts from the portfolio vault, draining all funds.
**Insight:** Audit every externally reachable function that mutates accounting state (balances, shares, debt) for missing access control and missing token-transfer side effects; leftover test/debug helpers are a recurring source of free-money bugs.