# Mismatching funding fees can result in the protocol incurring a deficit or insolvency risk

Funding fee cap applied to one side only in Elfi perps, so longs pay more than shorts receive, inflating pool value and enabling under-collateralized positions.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/258
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-30
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Perpetual futures funding fee accounting (MarketQueryProcess/LpPoolQueryProcess)
**Root cause:** When the per-qty funding fee delta exceeds the max cap, only the capped side's rate is used; the counterparty's realized funding fee is computed from the uncapped delta, so paid and received fees diverge.
**Steps:**
1. Set totalLongOpenInterest=150, totalShortOpenInterest=50, elapsed=10s, fundingRatePerSecond=1e-8.
2. Compute totalFundingFee=150*10*1e-8=1.5e-5.
3. longFundingFeePerQty=1.5e-5/150=1e-7; shortFundingFeePerQtyDelta=1.5e-5/50=3e-7.
4. Cap short delta at max 2e-7; long rate stays -1e-7.
5. Realized: longs pay 150*1e-7=1.5e-5, shorts receive 50*2e-7=1e-5; 0.5e-5 discrepancy.
6. Pool counts unsettledAmount as recoverable, so total value is overstated by the discrepancy.
**How found:** Code review of getUpdateMarketFundingFeeRate and pool accounting: noticed the cap is applied to one side's delta while the counterparty's realized fee uses the uncapped value, then constructed numeric example showing paid != received.
**Exploitation:** Open positions against the inflated pool value (baseAmount + unsettledFee) that assumes the full funding fee will be settled; the short side never receives the capped excess, so collateral backing is insufficient, risking bad debt/insolvency.
**Insight:** In funding-fee/settlement designs, verify that any cap or clamp is applied symmetrically to both payer and receiver; asymmetric clamping silently breaks the zero-sum invariant that pool accounting relies on.