# Possible to liquidate past the debt outstanding above the min borrow without liquidating the entire debt outstanding

Notional vault liquidation check used signed debt minus positive deposit, so liquidators could leave accounts below min borrow size, creating unprofitable bad debt.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90 + 0xleastwood
- Disclosed: 2023-03-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-03-notional-judging/issues/194
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** VaultValuation.sol liquidation validation logic
**Root cause:** The require compares a negative debtOutstanding minus a positive depositUnderlyingInternal against a positive minBorrowSize, so the left side is always negative and the check always passes.
**Steps:**
1. Set debtOutstanding = -100 USDC, depositUnderlyingInternal = 70 USDC, minBorrowSize = 50 USDC
2. Call liquidation with deposit 70 USDC against 100 USDC debt
3. Observe require((-100 - 70) < 50) evaluates true, no revert
4. Account left with -30 USDC debt below minBorrowSize
**How found:** Code review of the liquidation validation in VaultValuation.sol; noticed debtOutstanding is negative and depositUnderlyingInternal positive, making the subtraction always negative and the comparison trivially true.
**Exploitation:** Liquidator partially repays a vault position, leaving residual debt below the minimum borrow size; such dust positions are unprofitable to unwind, accumulating bad debt.
**Insight:** When validating post-liquidation debt against a minimum, check sign conventions: subtracting a positive deposit from a negative debt yields a more-negative number, so the inequality direction and negation must be verified with concrete signed values.