# StrategyVault can perform a full exit without repaying all secondary debt

Notional's full-exit check only verified primary debt was zero, letting a StrategyVault exit while secondary debt remained, leaving bad debt.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90 + 0xleastwood
- Disclosed: 2023-03-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-notional-judging/issues/184
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** VaultAccountAction / VaultSecondaryBorrow (Solidity vault accounting)
**Root cause:** The full-exit condition in VaultAccountAction only checks accountDebtUnderlying and vaultShares, not the secondary borrow debt, trusting the StrategyVault to have repaid it.
**Steps:**
1. StrategyVault borrows secondary currency via borrowSecondaryCurrencyToVault.
2. Vault account redeems all vault shares and clears primary debt (accountDebtUnderlying == 0, vaultShares == 0).
3. Full-exit branch sets maturity = 0 without checking secondary debt balances.
4. Secondary debt remains outstanding on Notional with no maturity/position to enforce repayment.
**How found:** Read the codebase comment stating vaults must ALWAYS repay secondary debt during redemption, then checked the full-exit condition at VaultAccountAction.sol:271 and noticed it only validates primary debt.
**Exploitation:** A leveraged vault (or a bug within it) exits fully while secondary debt is nonzero; Notional sets maturity to zero and skips collateral-ratio checks, stranding the secondary debt as protocol bad debt.
**Insight:** When a protocol documents an invariant ('must ALWAYS repay secondary debt') but delegates enforcement to an external contract, grep the exit/close paths for checks that only cover the primary asset and trust the delegate for the rest.