# Vaults can avoid liquidations by not letting their vault account be settled

Vault settlement refunds excess ETH natively to the vault account, letting a malicious vault revert the transfer and block liquidation, accruing bad debt.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: ShadowForce
- Disclosed: 2023-03-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-03-notional-judging/issues/199
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-8
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** VaultAccount settlement / TokenHandler prime cash withdrawal
**Root cause:** repayAccountPrimeDebtAtSettlement calls withdrawPrimeCash with withdrawWrappedNativeToken=false, so excess cash is sent as native ETH to the vault account, giving the recipient control over execution and the ability to revert.
**Steps:**
1. Vault has debt past maturity and excess cash from interest accrual in a borrow currency of ETH.
2. Liquidation triggers vault account settlement, calling repayAccountPrimeDebtAtSettlement.
3. Excess cash refund path calls `TokenHandler.withdrawPrimeCash(account, currencyId, primeCashRefund, pr, false)`.
4. Since underlying is Ether, `GenericToken.transferNativeTokenOut(account, withdrawAmount, false)` sends native ETH to the vault account.
5. Vault account's receive/fallback reverts, causing settlement to fail and liquidation to be blocked.
**How found:** Code review of the settlement refund path noticed withdrawPrimeCash is always called with withdrawWrappedNativeToken=false, meaning native ETH is sent directly to a user-controlled account, enabling revert-based griefing of settlement.
**Exploitation:** A vault owner deploys a vault account whose ETH-receiving function reverts. When a liquidator attempts to settle the matured vault, the native ETH refund transfer reverts, aborting settlement. The vault cannot be deleveraged, so bad debt accrues to the protocol instead of the vault being liquidated.
**Insight:** When a protocol refunds value to a user-controlled address mid-settlement, check whether the transfer is native (recipient controls execution) versus wrapped/pull-payment; any native send to an attacker address is a revert-griefing vector against liquidation/settlement flows.