# Unbacked tokens can be used for opening positions

Unsettled funding fees inflate a pool's reported available liquidity, letting a new trader open leverage exceeding the pool's real ETH balance.

- Payout: Contest reward
- Severity: medium
- Program: Elfi Protocol
- Credited: mstpr-brainbot
- Disclosed: 2024-05-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-elfi-protocol-judging/issues/102
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Perp DEX LP pool liquidity accounting (LpPoolQueryProcess/IncreasePositionProcess)
**Root cause:** updateMarketFundingFee adds realized-but-untransferred funding fee deltas to pool.unsettleAmount, and available liquidity is computed as (baseAmount+unsettleAmount)*limitFactor - holdAmount, so unsettled fees count as real liquidity before any transfer occurs.
**Steps:**
1. Alice opens 20x long 100k ETH, Bob 10x short 50k ETH; ETH pool baseAmount=100 ETH, holdAmount=95 ETH, max borrow 98%.
2. Alice tops up slightly, triggering FeeProcess::updateFundingFee -> MarketProcess::updateMarketFundingFee, adding 10 ETH to pool unsettleAmount.
3. Pool now: baseAmount=100, holdAmount=95, unsettle=10; available = (100+10)*0.98 - 95 = 12.8 ETH.
4. Carol borrows the full 12.8 ETH even though only 5 ETH was truly unborrowed; holdAmount becomes 107.8.
5. Later shorts pay longs, Alice closes; unsettle drops by 10 to 0, leaving baseAmount=100, holdAmount=12.8.
6. Carol's leveraged position was backed by Bob's unpaid funding fees rather than real pool liquidity.
**How found:** Code-reading of the liquidity query: noticed available liquidity formula adds unsettleAmount to baseAmount while holdAmount already reflects borrowed funds, and that realized funding fees are only marked, not transferred, until close.
**Exploitation:** Trader waits for a funding-fee imbalance where longs owe shorts (or vice versa) so unsettleAmount is large, then opens a position sized against inflated available liquidity, borrowing more than the pool actually holds; the debt is effectively covered by counterparties' unrealized funding fees.
**Insight:** When an accounting formula mixes 'pending/unsettled' deltas into a capacity check, test whether those deltas are backed by actual token transfers; funding-fee and PnL accruals that settle only at close are prime candidates for inflating borrow limits.