# Realized PnL omitted from debt or value

Check that every PnL, funding, and entry-price term is realized symmetrically on open and close

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2024-05-09. Updated 2026-10-29._

## How it works
Accounting formulas for pool value, debt, or share price must include every component that affects what a position is worth right now. The bug is omission or asymmetry: a term (realized PnL, accrued funding, entry price) is only folded in on one event (open, or close) and not the other, or is left out of the formula entirely. The reported number then diverges from the protocol's own settlement value, and anyone who can mint/redeem or borrow against it transacts at a wrong price.

## Where it shows up
- Value/debt formulas that sum balances + unrealized PnL + fees but skip a realized-PnL or funding term [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-3.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md)
- Flags like `needUpdateUnsettle=false` that skip resetting accrued amounts on close [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-3.md)
- Asymmetric update functions: `_addOI` recomputes entry price, `_subOI` does not [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-12.md)
- Tuple returns where an element (e.g. `owedRealizedPnl`) is discarded [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md)
- Integrations that reimplement a counterparty's account-value formula instead of mirroring it [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md)

## How to review
Identify every state variable and term feeding share price, pool value, or debt. For each, confirm it is updated on both increase and decrease, and that accrued fees/PnL enter the value at accrual time, not only at close. Compare the formula line-by-line against the source protocol's own settlement spec; check every returned tuple element is consumed. The invariant: value computed by the contract equals value the protocol would settle, at all times, including mid-position and after close.

## Variants seen
- Accrued funding excluded from pool value until position update/close [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-3.md)
- Realized PnL omitted from debt formula [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md)
- Entry price not recomputed on position decrease, leaving stale average [E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-12.md)

## Impact and severity
Mispriced LP share mint/redeem and misreported debt. Attackers sandwich the close event to inflate pool value before minting or redeeming [E1](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-3.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-12.md). Severity is high where the mispricing is exploitable in a single transaction; worse when the stale term persists across many positions and compounds.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-3.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-6.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-12.md