# Pool value does not consider the open funding fees

Elfi pool value omits accrued funding fees until a position closes, letting attackers sandwich the close to inflate pool value and misprice LP share mint/redeem.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/33
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Perp DEX LP pool value / share accounting (LpPoolQueryProcess, DecreasePositionProcess)
**Root cause:** getPoolIntValue sums baseTokenBalance.amount + unsettledAmount + marketPnL, but accrued funding fees only enter unsettledAmount when a position is updated/closed; for cross-margin positions the unsettled amount is not reset on close, so pool value jumps without supply change.
**Steps:**
1. Open a long cross-margin position (user0) and a small short (user1) so longs pay shorts funding.
2. Advance time (`mine(1000,{interval:300})`) to accrue funding fees; pool value unchanged because unsettledAmount not yet updated.
3. Observe pool value via `getPoolWithOracle` before close.
4. Close the long position via `createOrderRequest` DECREASE + `executeOrder`; `updateFundingFee` adds realized funding to `pool.addUnsettleBaseToken`, spiking pool value.
5. Mint/redeem LP shares at the inflated pool value (or sandwich the close) to capture the discrepancy.
**How found:** Code review of getPoolIntValue noticed unsettledAmount only updates on position update; traced updateFundingFee -> updateMarketFundingFee and saw cross-margin close passes needUpdateUnsettle=false, leaving the funding delta in unsettledAmount permanently.
**Exploitation:** Attacker watches for a pending position close that will realize funding fees, mints LP shares just before the close at the lower pool value, then redeems after the close at the inflated pool value, extracting value from existing LPs.
**Insight:** In perp/LP accounting, check whether every PnL/fee component that affects share price is realized at the same time it is accrued; look for flags like needUpdateUnsettle that skip resetting on cross-margin closes, creating a predictable value jump around position updates.