Elfi — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Elfi, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 42
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 42 closed, publicly disclosed Elfi reports indexed on CoinBuggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Integer overflow / underflow, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Elfi
- Integer overflow / underflow findings disclosed against Elfi
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Elfi: The implementation of `payExecutionFee()` didn't take `EIP-150` into consideration. Keepers can steal additional execution fee from users.
Elfi's GasProcess.processExecutionFee() undercharges nothing but over-counts gas: it derives the keeper's execution fee as startGas minus gasleft(), yet because the call into the external library is governed by EIP-150, only 63/64 of the remaining gas is forwarded and the 1/64 reserved in the caller is refunded to the keeper while still being counted as consumed. A malicious keeper can raise tx.gaslimit to inflate the reserved portion, inflating usedGas and pushing the computed fee above the user's actual execution cost. In the report's example, raising startGas from 164K to 6500K grows the keeper fee from 101K to 200K Gwei, reducing the user's refund to zero. The confirmed fix multiplies gasleft() by 64/63 to restore accurate accounting.
Elfi: If stable tokens depeg, short funding fees will not be accounted properly
Elfi's perpetual-futures funding-fee accounting uses a Masterchef-style per-quantity accumulator that is asymmetric: long positions accrue in the base token, but the short-side accumulator is denominated in USD and only converted to the margin token at the current price during settlement. Because the accumulator tracks USD rather than the actual token value over the accrual window, any deviation of the stable margin token from $1 means shorters settle at the latest price instead of the historical average, misattributing funding income and liability. The finding walks through a DAI depeg scenario showing shorters in profit are incentivized to close during a depeg (over-crediting tokens) while those with a loss are incentivized to wait for re-peg, making funding distribution unfair with the pool absorbing the imbalance. The protocol acknowledged the issue and declined to change the code, stating the pool is designed to bear stablecoin fluctuation risk under the assumption that stables trade at $1.
Elfi: Anyone can change the balance of an account to drain the entire portfolio vault
Elfi's AccountFacet exposes `batchUpdateAccountToken`, an unauthenticated state-update function that lets any caller overwrite the recorded balance of an account in the portfolio vault without depositing or transferring underlying tokens. Because the mutation performs no access control and no token movement, an attacker can write arbitrarily large amounts for tokens such as USDC and WBTC and then withdraw real funds from the vault. The issue was reported by more than twenty Watson teams, confirmed as high severity, and remediated by the protocol team in a pull request that the Lead Senior Watson signed off on.
Elfi: Users can use weth to replace any margin token in createUpdatePositionMarginRequest()
Elfi's PositionFacet.createUpdatePositionMarginRequest fails to validate that the isNativeToken flag matches the position's actual margin token. A user can set isNativeToken=true on a wBTC-margined position, which deposits ether into the shared trade vault while the request records wBTC as the margin token. On keeper execution the add-margin path transfers wBTC out of the vault to the LP pool, letting the attacker convert ether into other traders' deposited margin tokens and, because the vault's wBTC is consumed, block or revert legitimate update requests. The finding was confirmed by the protocol, fixed in a follow-up PR, and signed off by the Lead Senior Watson. The underlying cause is insufficient input validation tying the token deposit to the recorded margin token.
Elfi: Closing partial positions miscounts the settled fees
In Elfi's perpetuals protocol, the partial-close path in DecreasePositionProcess._updateDecreasePosition misprices settled fees. Each fee component (borrowing, funding, close) is already scaled down by the decrease quantity ratio, but the aggregate _getPosFees term used in the settleMargin computation divides by that ratio a second time. This under-deducts fees when net fees are positive, inflating the user's recorded PnL, and does the opposite when fees are negative. Because the bug is purely reachable through the normal partial-close flow with no special privileges, any trader can profit by closing positions in two parts instead of one. The finding was accepted as high severity and fixed in the protocol's PR, with the Lead Senior Watson signing off on the remediation.
Elfi: Incorrect settleFee process for cross-margin account
Elfi's DecreasePositionProcess._settleCrossAccount misfires on cross-margin positions because it applies the generated settle fee (borrow/funding/close) to the account and then, whenever the recorded PnL is non-negative, applies that same fee a second time in the opposite direction. This double-processing means traders who should pay a positive settle fee end up having it refunded, while the protocol cannot correctly redistribute fees between accounts. A secondary defect is that when a positive recordPnlToken is combined with a negative settledFee whose sum is negative, the code calls toUint256() on that negative sum, which reverts and blocks the decrease order entirely. The judges acknowledged the issue, the Elfi team fixed it via pull request 31, and the lead senior Watson signed off on the fix.
All reports in this group
- Elfi: When a position is closed, the execution fees for the canceled stop orders are lost for the userLogic error$0
- Elfi: `isHoldAmountAllowed` and `isSubAmountAllowed` wrong subtraction will result in DoSInteger overflow/underflow$0
- Elfi: Lack of execution fee mechanism in AccountFacetLogic error$0
- Elfi: `updateAllPositionFromBalanceMargin` function mistakenly increments positions "fromBalance"Logic error$0
- Elfi: If the stake token is minted from portfolio vault, positions from balances are not decreasedLogic error$0
- Elfi: Long orders always pays lesser in fees while short orders always pays higher due to oracle pricingLogic error$0
- Elfi: Pool value calculation skips accounting for stable token losses and short uPnLLogic error$0
- Elfi: Increasing leverage can make the position have "0" `initialMargin`Logic error$0
- Elfi: Uninitialized cache.redeemFee cause 0 redeem feeLogic error$0
- Elfi: Submitting mint request using user's trading balance and cancelling it will not refund tokens back to trading accountLogic error$0
- Elfi: Canceling a mint stake token can result in the execution fee being sent from the wrong vaultLogic error$0
- Elfi: Traders may decrease the loss via decrease the position's marginLogic error$0
- Elfi: User Collateral Cap Check IssueLogic error$0
- Elfi: redeem stake token may be Dos because there is not enough balance in stake pool.Logic error$0
- Elfi: Keepers can open positions that are already liquidatableLogic error$0
- Elfi: Pool value does not consider the open funding feesLogic error$0
- Elfi: Users profit in short cross will leave the fees in UsdPool instead of LpPoolLogic error$0
- Elfi: The balance.unsettledAmount is missing in the calculations for `getMaxWithdraw` and `isSubAmountAllowed` in UsdPool.solLogic error$0
- Elfi: Attacker can inflate stake rewards as he wants.Logic error$0
- Elfi: Future upgrades may be difficult or impossibleLogic error$0
- Elfi: `updatePositionFromBalanceMargin` function returns "0" if amount to be updated is negativeLogic error$0
- Elfi: Users can gas grief or completely block keepers from executing ordersLogic error$0
- Elfi: Mismatching funding fees can result in the protocol incurring a deficit or insolvency riskLogic error$0
- Elfi: If cross positions use the same margin token as collateral and close without liability, then fee accounting will be completely wrongLogic error$0
- Elfi: In Cross Margin mode, the user’s profit calculation is incorrect.Logic error$0
- Elfi: Call of ````revokeAllRole()```` would fail silentlyLogic error$0
- Elfi: A significant ````105,983```` gas cost of ````processExecutionFee()```` execution is not accounted in the keeper's compensationLogic error$0
- Elfi: Missing compensation for the ````21,000```` intrinsic gas costLogic error$0
- Elfi: Users can have positions with a margin lower than the allowed minimum marginLogic error$0
- Elfi: Cross positions that exceed the allowed margin can be openedLogic error$0
- Elfi: Contract will reach a point where users will not be able to call `deposit`Logic error$0
- Elfi: Excess fromBalance removal not added to other positions fromBalance's when leveraging upLogic error$0
- Elfi: LpPool's can become insolvent if shorters are in huge profitsLogic error$0
- Elfi: The keeper will suffer continuing losses due to miss compensation for L1 rollup feesLogic error$0
- Elfi: Lack of oracle setting in autoReducePositionsLogic error$0
- Elfi: Closing positions does not decrease the pool's entry price, leading to misleading pool value calculationsLogic error$0