Yep, so two destination for both ENV and LFO.
There are also Filter ENV and Filter LFO.
I think both are a third destination, hard wired to the ENV and the LFO.
Oh, and LFO goes FM. Tasty.
[Edit] My bad : filter LFO is a destination of the LFO...
Damn. I have to RTFM !!!
[Edit 2] From the specs on the website
1 × Assignable envelope generator/envelope follower
1 × Assignable LFO
From the Manual which is different from the little manual that was in the box :
You can set the ENV to go AR/AD or FLW which follow the flow
So I guess it's either ENV generator OR ENV follower in this scheme.
Now that I found that online manual is more complete, I might find other subtleties
[EDIT 3] I found it on p. 23 : “The envelope has three modulation destinations. [...] The third modulation destination is permanently set to the filter cutoff.”
Same for LFO (p. 24)