# DnGmxJuniorVaultManager#_rebalanceBorrow logic is flawed and could result in vault liquidation

In Rage Trade's DnGmxJuniorVaultManager, _rebalanceBorrow selects the zero-amount asset when only one token needs rebalancing, so the vault never rebalances and can be liquidated.

- Payout: Contest reward
- Severity: high
- Program: Rage Trade
- Credited: clems4ever
- Disclosed: 2022-10-28
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-rage-trade-judging/issues/62
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-rage-trade%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** DnGmxJuniorVaultManager._rebalanceBorrow (Solidity vault library)
**Root cause:** In the single-asset branch, the condition `if (btcAssetAmount == 0)` selects the zero-amount asset (wBTC) instead of the non-zero one, so the flashloan borrows/repays the wrong token and the needed rebalance never executes.
**Steps:**
1. Read `_rebalanceBorrow` in DnGmxJuniorVaultManager.sol L353-458.
2. Note case-1 returns when both `btcAssetAmount == 0 && ethAssetAmount == 0`.
3. In case-2 (`btcAssetAmount == 0 || ethAssetAmount == 0`), observe `if (btcAssetAmount == 0)` sets `assets[0]` to wBTC/USDC with `amounts[0] = btcAssetAmount` (zero).
4. Trigger scenario: one asset price rises sharply, only that asset's amount exceeds threshold; the other is zero.
5. Result: flashloan targets the zero-amount asset, rebalance is a no-op, debt ratio drifts until liquidation.
6. Fix: change to `if (btcAssetAmount != 0)`.
**How found:** Code reading of the branch logic: comment says 'only one entry required for the non-zero amount token' but the following `if (btcAssetAmount == 0)` selects the zero-amount token, contradicting the stated intent.
**Exploitation:** Not weaponized; requires market movement where one asset (e.g. ETH) rises rapidly while the other stays flat, causing the vault's borrow to become unbalanced and the rebalance path to silently no-op, eventually enabling liquidation of the vault.
**Insight:** When a branch comment states intent ('non-zero amount token'), diff the comment against the actual condition — inverted zero-checks in mutually-exclusive branches are a recurring audit find.