# Long orders always pays lesser in fees while short orders always pays higher due to oracle pricing

Elfi perps compute long-position fees using oracle min price and shorts with max, so longs systematically underpay borrowing/funding fees and shorts overpay.

- Payout: Contest reward
- Severity: high
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/45
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:oracle-manipulation

**Target:** Perpetual futures fee accounting (FeeProcess/DecreasePositionProcess)
**Root cause:** Borrowing and funding fees are converted to USD via OracleProcess.getLatestUsdPrice(marginToken, isLong), which returns the min price for longs and max for shorts, so identical token-denominated fees yield different USD values per side.
**Steps:**
1. Open a LONG position on tokenA; accrue borrowing and funding fees in token units.
2. Close position: updateBorrowingFee/updateFundingFee convert fee deltas to USD using getLatestUsdPrice(marginToken, true) = oracle min price.
3. settledMargin = usdToTokenInt(initialMarginInUsd - _getPosFee + pnlInUsd, decimals, tokenPrice) with tokenPrice = max price for longs.
4. Repeat with a SHORT: fees convert at max price, inflating USD fee total and reducing settled margin.
5. Compare: 5 tokens fee at min 0.9 = $4 vs max 1.0 = $5; long settled margin 142 vs short paying $10 fees.
**How found:** Code review of fee conversion paths in FeeProcess/DecreasePositionProcess, noticing getLatestUsdPrice is passed position.isLong and returns asymmetric min/max oracle prices.
**Exploitation:** No direct theft; a trader can systematically favor long positions to pay less borrowing/funding fees and receive more funding from shorts, extracting value from the pool and short counterparties at scale.
**Escalation:** Advantage scales with position size and fee volume; repeated long-side positions drain pool fee revenue and transfer value from shorts.
**Insight:** When a protocol passes a boolean like isLong into an oracle price helper, check whether that helper returns min vs max price — any fee, PnL, or collateral math using that asymmetric price will systematically favor one side.