# If the accounted token balance is higher than actual token balance some transfers can send "0" tokens to destination

Elfi vault transferOut silently skips transfer when balance is insufficient, so storage accounting credits tokens that were never sent, causing insolvency.

- Payout: Contest reward
- Severity: medium
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/100
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AM-10
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Solidity perp vault transferOut / DecreasePositionProcess settlement
**Root cause:** VaultProcess.transferOut is called with a flag that skips the actual token transfer when the vault balance is insufficient, but callers still update storage balances as if tokens moved.
**Steps:**
1. Trigger a late liquidation under extreme market conditions so pool/vault actual token balance falls below accounted balance.
2. Call close/decrease position path reaching `DecreasePositionProcess::_settleCrossAccount` / `_settleIsolateAccount`.
3. These call `VaultProcess.transferOut(..., true)`; the boolean causes the transfer to be skipped when balance is insufficient.
4. Storage balances are updated as if the full amount was sent while 0 tokens actually move.
5. Repeat across users to drain accounting vs actual balance, leaving vault insolvent.
**How found:** Code review of VaultProcess.transferOut and its callers in DecreasePositionProcess, noticing the boolean flag skips transfer on insufficient balance while storage accounting is unconditionally updated.
**Exploitation:** Under volatile market conditions causing undercollateralized positions/funding losses, closing positions credits users in storage without transferring tokens; the discrepancy accumulates until the vault cannot honor withdrawals.
**Insight:** When a transfer helper takes a 'skip on insufficient balance' flag, audit every caller: any path that updates accounting before/independent of the actual transfer creates a phantom-balance insolvency. Check return values and reconcile storage vs real balance.