# Cross positions that exceed the allowed margin can be opened

Elfi cross-margin cap applies discount after subtracting used margin, letting users loop orders to exceed the intended max margin.

- Payout: Contest reward
- Severity: medium
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/34
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss

**Target:** Perp DEX cross-margin order accounting (OrderProcess/AccountProcess)
**Root cause:** _getTokenNetValue multiplies (amount - usedAmount) by discount instead of discounting amount before subtracting usedAmount, so residual net value remains after a max-margin order, allowing repeated orders.
**Steps:**
1. Deposit 1 WBTC (~$25k) into cross account.
2. Create LONG BTCUSD increase order with orderMargin = 24750 (1% discount applied).
3. Execute order; getCrossAvailableValue returns ~247.5 instead of 0.
4. Create another order with margin 250; execute; repeat until margin below minimum.
5. Each loop adds margin beyond the intended discount cap.
**How found:** Researcher computed getCrossAvailableValue after a max-margin order and noticed it wasn't zero because (amount - usedAmount) * discount leaves residual value; confirmed via coded PoC looping orders.
**Exploitation:** User repeatedly opens cross-margin increase orders, each time consuming the residual available value left by the discount miscalculation, accumulating a position margin above the protocol's intended cap.
**Escalation:** Looping orders compounds the over-margin; larger discounts (e.g. 10%) yield larger over-leverage (900 -> 950).
**Insight:** When a cap is enforced by discounting a balance, check whether the discount is applied before or after subtracting used amounts; residual value after a max-size action signals a loopable cap bypass.