# Fee refund from wrong vault

Refund or fee paid from a vault other than the one that collected it, or captured by the caller

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2024-05-09. Updated 2026-10-30._

## How it works
A fee is collected into one pot but paid out of another. The payout path chooses its source from a flag or condition that does not actually track where the money was deposited. When the flag and the deposit destination disagree, the refund drains a vault that never received the fee, so that vault's accounting drifts from reality. The flag is set from a proxy condition (token type, amount threshold) rather than the real deposit destination.

## Where it shows up
- A boolean like `isExecutionFeeFromLpVault` set from one condition (native token, amount threshold) but used later to choose a fund source.
- Deposit routing that can send collateral to a portfolio vault while the fee flag still points at the LP vault.
- Cancel/refund paths that read the flag without re-checking the actual deposit destination.
- Any branch that sets a fund-source flag without consulting the `isCollateral`/destination parameter.

## How to review
For every fee/refund payout, trace the money both ways: where it was deposited and where it is withdrawn. The invariant: the vault or pool a refund is drawn from must be the same one that received the fee, and the flag selecting the source must be set from the actual deposit destination, not a proxy condition. Check every branch that sets the flag against the real destination.

## Variants seen
- Refund from LP vault when fee was deposited to portfolio vault as collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-21.md).

## Impact and severity
Breaks vault accounting and can block other users' orders [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-21.md). Severity rises when the wrong vault is shared, so one bad refund corrupts balances others depend on.

## Adjacent but distinct
Two related shapes share the "fee goes to the wrong party" symptom but not the vault-mismatch root cause: an executor capturing a bot fee by bundling the state change and close atomically via a proxy [E2](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-17.md), and an early `break` in a fee-splitting loop skipping the seller-recipient check [E3](https://bugbountylibrary.com/r/c4%3A2022-11-foundation%3AM-02.md). Review these separately: for executor-paid fees, check whether a user can become the executor atomically; for fee loops, confirm every recipient is evaluated before any state-mutating check runs.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-21.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AM-17.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-11-foundation%3AM-02.md