# Accounts with ETH loans can not be liquidated if LEther's underlying is set to `address(0)`

If LEther's underlying is set to address(0), ETH borrowers get address(0) in their asset list, making IERC20(address(0)).balanceOf revert and blocking all liquidations.

- Payout: Contest reward
- Severity: medium
- Program: Sentiment
- Credited: Lambda
- Disclosed: 2022-08-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-08-sentiment-judging/tree/main/034-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-4
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:liquidation

**Target:** AccountManager/RiskEngine liquidation path with LEther underlying
**Root cause:** setLToken allows underlying==address(0) and settle/_valueInWei special-case address(0), but _getBalance iterates assets calling IERC20(asset).balanceOf, which reverts on address(0).
**Steps:**
1. Deploy LEther with underlying=address(0) via init and Registry.setLToken(address(0), LEther)
2. User calls AccountManager.borrow(account, address(0), amt); address(0) is added to account assets and borrows
3. Account becomes unhealthy; liquidator calls liquidate(account)
4. isAccountHealthy -> _getBalance loops assets and calls IERC20(address(0)).balanceOf(account), reverting the tx
5. Liquidation permanently blocked for that account
**How found:** Noticed settle() and _valueInWei() explicitly handle asset==address(0), implying address(0) is a valid asset, then traced borrow() adding it to the assets list and _getBalance assuming all assets are IERC20.
**Exploitation:** No direct theft; a borrower of native ETH could intentionally become undercollateralized and avoid liquidation because every liquidate() call reverts in _getBalance, leaving bad debt in the protocol.
**Insight:** When code special-cases a sentinel value like address(0) in one path, check every other path that iterates the same list for assumptions that the sentinel violates (here, IERC20 calls).