# Slippage/Minimum amount does not work during single-side redemption

Notional's Curve Convex helper overwrote caller slippage with a pro-rata min amount, letting single-sided redemptions execute at up to ~75% slippage and drain vault value.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2023-02-27
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-notional-judging/issues/10
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Curve2TokenConvexHelper settlement / remove_liquidity_one_coin
**Root cause:** _executeSettlement overwrites params.minPrimary/minSecondary with TwoTokenPoolUtils._getMinExitAmounts, which computes a pro-rata share of pool balances rather than the actual single-coin withdrawal output, so the min amount is far below fair value for imbalanced pools.
**Steps:**
1. Call settleVault/settleVaultEmergency on Curve2TokenConvexVault with a RedeemParams where secondaryTradeParams.length == 0 (single-sided).
2. Observe _executeSettlement overwrites params.minPrimary with _getMinExitAmounts = primaryBalance*poolClaim*poolSlippageLimitPercent/(totalSupply*BASIS).
3. _unstakeAndExitPool calls remove_liquidity_one_coin(poolClaim, primaryIndex, params.minPrimary).
4. With imbalanced pool (e.g. 50 DAI/150 USDC, 100 LP), redeeming 50 LP yields ~100 DAI fair value but minPrimary is only ~24.94 DAI, so trade executes at ~75% slippage.
**How found:** Code reading of _executeSettlement noticed params.minPrimary/minSecondary are unconditionally overwritten by _getMinExitAmounts; comparing the pro-rata formula against the actual single-coin withdrawal economics on an imbalanced pool revealed the min amount is far too low.
**Exploitation:** Attacker or unlucky settlement triggers single-sided redemption on an imbalanced Curve pool; the auto-computed minPrimary (~pro-rata share) is far below the fair single-coin output, so the vault accepts heavily slippaged redemption, losing value to LPs/arbitrageurs at shareholders' expense.
**Insight:** When a helper auto-computes slippage minimums, check whether the formula matches the actual exit path: pro-rata balance share is wrong for remove_liquidity_one_coin, which needs calc_withdraw_one_coin-based minimums.