# Notional Double Counting Free Collateral Bugfix Review

Notional V2 failed to clear activeCurrencies when changing bitmap currency, double-counting free collateral and letting an attacker borrow out all DAI market liquidity.

- Payout: $1,000,000
- Severity: critical
- Program: Notional
- Credited: 0x60511e57
- Disclosed: 2022-02-02
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/notional-double-counting-free-collateral-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-notional-double-counting-free-collateral-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic

**Target:** Notional V2 AccountContextHandler / Account Action contract (Ethereum)
**Root cause:** enableBitmapForAccount() only calls setActiveCurrency() and never clears the prior active bitmap currency copy in accountContext.activeCurrencies when the bitmap currency is changed, so the same asset is counted twice in free collateral.
**Steps:**
1. Call enableBitmapCurrency in the Account Action contract to set a dummy/ETH bitmap currency.
2. Call depositUnderlyingToken() to deposit the target currency (e.g. DAI); setActiveCurrency marks it active in activeCurrencies because it is not the current bitmap currency.
3. Call enableBitmapCurrency again, this time setting DAI as the bitmap currency; the stale activeCurrencies entry is not cleared.
4. Free collateral now counts DAI twice, doubling perceived collateral.
5. Transfer out double the fCash without the account registering as undercollateralized.
6. Send fCash to another account and convert to underlying via a Notional market to drain funds.
**How found:** Whitehat read the account-context code path: noticed enableBitmapForAccount only calls setActiveCurrency and never clears the previous active bitmap currency in activeCurrencies, then reasoned that a deposit between two bitmap-currency changes would leave a duplicate entry feeding free-collateral math.
**Exploitation:** Attacker uses three attacker contracts driven by a brownie script on a mainnet fork: enable dummy bitmap, deposit DAI, re-enable bitmap as DAI to double-count collateral, then borrow/withdraw double the fCash and convert to underlying through a Notional market, draining the DAI market (26.2M DAI demonstrated).
**Escalation:** Repeatable across all currencies/markets since the flaw is in shared account-context logic, enabling drain of almost all liquidity on all currencies.
**Insight:** When a setter only adds state and never clears the prior value, look for a sequence (set A, deposit B, set B) that leaves both entries live in a shared accounting array; duplicated entries in collateral/balance arrays silently double-count value.