# If the stake token is minted from portfolio vault, positions from balances are not decreased

Minting stake tokens from portfolio vault balances debits the account but fails to update position fromBalances, inflating cross available value and letting users over-open positions.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/106
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-22
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Solidity perp contracts MintProcess / PositionMarginProcess
**Root cause:** MintProcess._transferFromAccount debits the trade account token balance via subTokenIgnoreUsedAmount but never calls PositionMarginProcess.updateAllPositionFromBalanceMargin, unlike the withdraw flow, so position fromBalances stay stale.
**Steps:**
1. Call mint stake token with portfolio vault balance as funding source so _transferFromAccount runs.
2. Observe tradeAccount.subTokenIgnoreUsedAmount reduces balance but positions' fromBalance unchanged.
3. Compare to withdraw() which calls PositionMarginProcess.updateAllPositionFromBalanceMargin with negative amount.
4. Cross available value computed from stale fromBalance exceeds true collateral.
5. Open cross positions larger than actual collateral allows.
**How found:** Compared the mint-from-portfolio-vault path against the withdraw path and noticed withdraw updates all position fromBalances while mint does not, then reasoned about cross available value impact.
**Exploitation:** User mints stake tokens using cross portfolio balance; the debit reduces balance but not position fromBalance, so getCrossAvailableValue reports inflated collateral, enabling oversized cross positions beyond entitlement.
**Insight:** When a protocol has multiple paths that debit the same account balance, diff each path against the canonical one (withdraw) for missing position/accounting side effects like fromBalance updates.