# Existing Slippage Control Can Be Bypassed During Vault Settlement

Notional vault settlement slippage check treated 0% as 'no limit', letting anyone call settleVaultEmergency and execute trades with unlimited slippage.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2022-09-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/73
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Balancer leverage vault settlement (MetaStable2/Boosted3) via TradingModule
**Root cause:** SettlementUtils._decodeParamsAndValidate only reverts when oracleSlippagePercent > limit; 0 passes, and TradingUtils._getLimitAmount interprets slippageLimit==0 as 'no limit' (max for exact-out, 0 for exact-in).
**Steps:**
1. Call `settleVaultEmergency(maturity, redeemParams)` with `get_dynamic_trade_params(DEX_ID, TRADE_TYPE, 0, ...)` setting oracleSlippagePercent=0.
2. Validation `0 > 10e6` is false, so no revert.
3. `executeTradeWithDynamicSlippage` calls `getLimitAmount` with dynamicSlippageLimit=0, returning type(uint256).max (exact-out) or 0 (exact-in).
4. Trade executes against DEX with no effective slippage bound; assert totalStrategyTokens==0 confirms settlement succeeded.
**How found:** Code review of the validation condition and the downstream _getLimitAmount special-case where slippageLimit==0 means unlimited; noticed 0 passes the > check but disables the limit.
**Exploitation:** Permissionless caller triggers settleVaultEmergency with zero slippage param, forcing the vault to swap through Curve/Balancer/Uniswap/0x at arbitrary slippage, extracting value from vault depositors via sandwich/MEV.
**Insight:** When a sentinel value (0) means 'no limit' downstream, check whether the upstream validator's inequality accidentally admits that sentinel; audit boundary values 0 and max against every 'limit' parameter.