# repayAccountPrimeDebtAtSettlement() user lost residual cash

In Notional's repayAccountPrimeDebtAtSettlement, primeCashRefund computed from netPrimeDebtChange minus accountPrimeStorageValue is always zero, so users lose residual cash on vault settlement.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: bin2chen
- Disclosed: 2023-03-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-notional-judging/issues/172
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** VaultAccount.sol repayAccountPrimeDebtAtSettlement settlement logic
**Root cause:** After setting netPrimeDebtChange = accountPrimeStorageValue, the refund is computed as netPrimeDebtChange.sub(accountPrimeStorageValue), which is always zero; it should use netPrimeDebtRepaid.sub(accountPrimeStorageValue).
**Steps:**
1. Call settleVaultAccount() on a vault account where netPrimeDebtRepaid < accountPrimeStorageValue.
2. Observe repayAccountPrimeDebtAtSettlement sets netPrimeDebtChange = accountPrimeStorageValue and finalPrimeDebtStorageValue = 0.
3. primeCashRefund = convertFromUnderlying(convertDebtStorageToUnderlying(netPrimeDebtChange.sub(accountPrimeStorageValue))) evaluates to 0.
4. withdrawPrimeCash transfers 0 to the account; residual cash is never refunded.
**How found:** Code reading of the settlement refund branch; noticed the variable used in the subtraction was just assigned to the subtrahend, making the expression identically zero.
**Exploitation:** Any user settling a vault account with residual prime cash after debt repayment receives a zero refund; the residual value is silently retained rather than transferred.
**Insight:** When a refund is computed from a variable that was just overwritten in the same branch, check that the original input (here netPrimeDebtRepaid) is used rather than the clamped value; self-subtraction patterns are a reliable smell in settlement/refund math.