# Ineffective slippage mechanism when redeeming proportionally

Notional's proportional redemption min-amount check is computed from the same spot balances as Curve's remove_liquidity, so it can never trigger, exposing vault settlements to sandwich slippage.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2023-02-27
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-notional-judging/issues/12
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Curve2TokenConvexHelper / TwoTokenPoolUtils settlement logic in leveraged vaults
**Root cause:** _getMinExitAmounts derives minPrimary/minSecondary from current pool balances times poolClaim/totalSupply with a 0.25% discount, while Curve's remove_liquidity returns exactly balances*poolClaim/totalSupply with no discount, so the returned amount always exceeds the minimum.
**Steps:**
1. Note _executeSettlement calls _getMinExitAmounts to set params.minPrimary/minSecondary automatically.
2. Compute minPrimary = primaryBalance * poolClaim * 9975 / (totalSupply * 10000).
3. Curve remove_liquidity returns amounts[i] * _amount / total_supply with no discount.
4. Since discounted min < actual proportional return for any pool state, the assert value >= _min_amounts[i] never fails.
5. Sandwich the settlement: manipulate pool balances before redemption so the proportional return is worse than fair value; the min check still passes.
**How found:** Code reading: compared the discount applied in _getMinExitAmounts against Curve's remove_liquidity source, which uses identical spot-balance proportional math without discount, concluding the minimum is mathematically always below the actual return.
**Exploitation:** Attacker sandwiches the vault settlement transaction: skews Curve pool balances (e.g. via a large swap) so the proportional remove_liquidity payout is unfavorable, lets the settlement execute (min check cannot revert), then reverses the swap to capture the difference from vault shareholders.
**Insight:** When a protocol computes its own slippage floor for an external AMM call, verify the floor's formula differs from the AMM's payout formula; if both use the same spot balances, the check is a no-op and the position is sandwichable.