# Users profit in short cross will leave the fees in UsdPool instead of LpPool

In cross SHORT positions closed at a profit, only closeFee is sent to LpPool while borrowing/funding fees remain stranded in UsdPool, misaccounting protocol fees.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/261
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-31
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** DecreasePositionProcess.sol fee settlement logic
**Root cause:** When a cross SHORT position closes in profit, the settlement path sends only closeFee from UsdPool to LpPool, leaving settledBorrowingFee and settledFundingFee in UsdPool instead of routing them to LpPool.
**Steps:**
1. Open cross SHORT: 100 USDC margin, 5x, token at $1; fee=2 USDC, increaseMargin=98, increaseQty=$490.
2. Price drops to $0.9; close entire position: totalPnlInUsd=+49, settledBorrowingFee=4, settledFundingFee=4, closeFee=2, settledFee=10 tokens.
3. Observe settlement: 55.3 USDC profit sent UsdPool->portfolio vault, 2 USDC closeFee sent UsdPool->LpPool.
4. Remaining 8 USDC of fees stay in UsdPool rather than being forwarded to LpPool.
**How found:** Enumerated all position-close scenarios (cross/isolated, long/short, profit/loss) and compared where fees land; found cross SHORT profit is the only case where fees remain in UsdPool instead of LpPool.
**Insight:** When auditing fee accounting, enumerate the full matrix of position types (cross/isolated x long/short x profit/loss) and trace each fee component's destination; a single asymmetric branch often misroutes fees.