# Traders may decrease the loss via decrease the position's margin

Elfi's _executeReduceMargin ignores unrealized PnL, letting an underwater trader withdraw margin that should be locked, dodging liquidation losses.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: jennifer37
- Disclosed: 2024-05-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/82
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-20
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** Perp position margin management (PositionMarginProcess.sol)
**Root cause:** _executeReduceMargin computes maxReduceMarginInUsd as initialMarginInUsd minus max-leverage margin, without subtracting current unrealized PnL, so an unhealthy position can still release margin.
**Steps:**
1. Open a long BTC position with 0.1 BTC margin at price 50000.
2. Price drops to 40000; position is now liquidatable and close order reverts with PositionShouldBeLiquidation.
3. Call `createUpdatePositionMarginRequest` with `isAdd: false`, `updateMarginAmount: precision.token(2462,18)`.
4. Execute `executeUpdatePositionMarginRequest` with oracle price 40000.
5. Observe wbtc balance of user0 increases despite the position being underwater.
**How found:** Reviewer read _executeReduceMargin and noticed maxReduceMarginInUsd only subtracts the max-leverage margin requirement, never the position's current PnL, then wrote a Foundry test showing an underwater position could still withdraw margin.
**Exploitation:** Trader opens a leveraged position, waits until it is at/beyond liquidation threshold where closing is blocked, then submits a decrease-margin request; the contract transfers margin out based on initialMarginInUsd minus max-leverage margin, ignoring the negative PnL, so the trader recovers funds that should be forfeited to LPs.
**Insight:** When auditing margin/leverage math, check every path that releases collateral (reduce margin, partial close, add/remove isolated margin) for whether it recomputes health using current oracle PnL, not just static initial margin and leverage caps.