# Cross available value is not accounting the position fees

Elfi Protocol's cross available value ignores unsettled position fees, letting accounts open or withdraw more margin than their true collateral supports.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/42
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Perp DEX margin/collateral accounting (AccountProcess.getCrossAvailableValue)
**Root cause:** getCrossAvailableValue subtracts negative PnL but not closeFee/borrowingFee/fundingFee, so unrealized fees that will reduce settled margin are not deducted from available margin.
**Steps:**
1. Read AccountProcess::getCrossAvailableValue() at AccountProcess.sol#L127-L147.
2. Note formula subtracts totalPnl only when negative, but no fee term.
3. Construct account: totalNetValue=200, totalIMUsd=100, totalUsedValue=100, totalBorrowingValue=100, totalPnl=0, totalFees=20.
4. Compute cross available value = 100, though true value after fees is 80.
5. Open another position or withdraw the 100 collateral, exceeding real margin.
**How found:** Code review of margin calculation; noticed PnL is conservatively subtracted when negative but analogous fee liabilities are absent from the formula.
**Exploitation:** Account with pending fees opens additional positions or withdraws collateral equal to inflated cross available value; in extreme fee cases position becomes immediately liquidatable or undercollateralized.
**Insight:** When auditing margin/health calculations, enumerate every value that reduces settled equity (fees, funding, borrow interest) and verify each is deducted symmetrically with negative PnL.