# Possible to create vault positions ineligible for liquidation

Self-liquidation/settlement lets a vault account hold both secondary debts below minAccountSecondaryBorrow, so checkMinBorrow blocks all future deleverage, making the position unliquidatable.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90 + 0xleastwood
- Disclosed: 2023-03-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-03-notional-judging/issues/202
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** VaultLiquidationAction / VaultSecondaryBorrow (vault deleverage & settlement)
**Root cause:** checkMinBorrow is skipped during settlement and only one currency can be reduced per deleverage, while updateAccountSecondaryDebt checks both secondary debts; sub-minimum debts in both currencies can be created and then never reduced one-at-a-time.
**Steps:**
1. Open vault account with only secondary-currency debt (no primary debt), e.g. Y debt and X cash in secondary currencies.
2. Trigger settleVaultAccount() which skips checkMinBorrow, leaving both accountDebtOne and accountDebtTwo non-zero but below minAccountSecondaryBorrow after cash offsets debt.
3. Attempt deleverageAccount() on the prime vault: only one currencyIndex can be paid down per call.
4. VaultSecondaryBorrow.updateAccountSecondaryDebt() runs `require(accountDebtOne == 0 || minAccountSecondaryBorrow[0] <= -accountDebtOne)` and same for debtTwo; the untouched currency still violates min borrow, reverting.
5. Repeat across many vault positions to accumulate unliquidatable exposure.
**How found:** Code review of deleverageAccount and _reduceAccountDebt: noticed checkMinBorrow is skipped in settlement and only one currency updated per deleverage, then traced updateAccountSecondaryDebt checking both debts simultaneously.
**Exploitation:** Attacker self-manipulates their own vault account debt/cash via settlement (or liquidateVaultCashBalance per T-Woodward) to push both secondary debts below the minimum, then no liquidator can deleverage since each call reverts on the other currency's min-borrow check; repeated across accounts accrues bad debt.
**Escalation:** Scaling by opening numerous vault positions to rack up protocol exposure and bad debt, potentially insolvency.
**Insight:** When a per-call operation can only touch one of several coupled state variables but the invariant check validates all of them, look for a path (settlement, cash liquidation) that skips the check to seed an invalid combined state that blocks all future corrective calls.