Elfi — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Elfi, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Elfi reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Elfi
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Elfi: `updatePositionFromBalanceMargin` function returns "0" if amount to be updated is negative
When a cross-margin position is closed, Elfi's PositionMarginProcess updates the from-balance bookkeeping of all remaining cross positions to redistribute the freed/absorbed margin. In updatePositionFromBalanceMargin, for a negative change token the code first zeroes position.initialMarginInUsdFromBalance inside a storage pointer, then reads that same (now-zeroed) value back into changeAmount, so the intended token decrease is computed as 0 instead of the correct amount. Because the whole loop iterates over every other cross position using that storage pointer, the error cascades: later positions lose their entire from-balance instead of the appropriate marginal decrease, so the account's usable borrowing capacity is overstated. This is a high-severity cross-margin accounting bug, confirmed and fixed by reordering the two lines so changeAmount is computed from the pre-zeroed value.
Elfi: Long orders always pays lesser in fees while short orders always pays higher due to oracle pricing
Elfi's perpetuals settlement computes the three position fees (close, borrowing, funding) using an oracle price that depends on the position's isLong flag: longs are priced with the oracle min price and shorts with the max price. Because the margin token's USD value differs between min and max, long orders systematically underpay all fees (settled margin and recorded PnL end up inflated), while short orders overpay. This creates a structural incentive asymmetry that favors opening long positions, distorts funding/borrowing fee distribution between users and the pool, and could be economically exploitable at scale. The issue was confirmed as high severity by the Sherlock lead judge and fixed by the protocol team in a follow-up PR signed off by the Lead Senior Watson.