# `TradingUtils::_executeTrade` will leak ETH to WETH

Exact-out ETH-to-WETH trades deposit trade.limit instead of trade.amount, leaving excess ETH stuck as WETH and misreporting amountSold.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: lemonmon
- Disclosed: 2022-09-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/98
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** TradingUtils.sol leveraged-vaults trading library
**Root cause:** When sellToken is ETH and dex is Uniswap, _executeTrade wraps ETH to WETH using trade.limit for exact-out trades rather than trade.amount, and never unwraps/recovers the untraded excess.
**Steps:**
1. Call _executeTrade with sellToken=ETH, dex=Uniswap, exact-out trade where trade.limit > trade.amount
2. Observe WETH deposit of trade.limit instead of trade.amount
3. Only trade.amount is consumed by the swap; excess WETH remains in contract
4. _executeInternal computes amountSold from ETH balance, returning trade.limit instead of actual sold amount
**How found:** Code review of _executeTrade and _executeInternal: noticed WETH wrap uses trade.limit for exact-out while swap consumes only trade.amount, and amountSold derived from ETH balance.
**Exploitation:** Not weaponized; accounting error and locked excess ETH/WETH from exact-out ETH sells via Uniswap.
**Insight:** In DEX routers wrapping native tokens, check whether the wrap amount matches the actual swap input for exact-out vs exact-in paths; balance-delta accounting on the wrong token masks the leak.