# Vault account might not be able to exit after liquidation

After a large liquidation leaves positive cash in a Notional vault account, exitVault reverts because redeemWithDebtRepayment requires tempCashBalance==0, trapping user funds.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: xiaoming90 + 0xleastwood
- Disclosed: 2023-03-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-notional-judging/issues/192
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AM-13
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** VaultConfiguration.sol exitVault / redeemWithDebtRepayment
**Root cause:** exitVault requires vaultAccount.tempCashBalance == 0 in redeemWithDebtRepayment, but a post-liquidation positive cash balance (x - y > 0) is never refunded or cleared, so the require reverts.
**Steps:**
1. Liquidate a large portion of a vault account, depositing large cash into its cash balance; interest accrues so primaryCash = x > 0.
2. Owner calls `exitVault`; `vaultAccount.tempCashBalance` set to x.
3. `lendToExitVault` calls `updateAccountDebt`; tempCashBalance becomes x - y where y is primeCashCostToLend.
4. If x > y, tempCashBalance remains > 0.
5. `redeemWithDebtRepayment` hits `require(vaultAccount.tempCashBalance == 0)` at VaultConfiguration.sol#L429 and reverts; owner cannot exit.
**How found:** Code-reading of exitVault flow: traced tempCashBalance through lendToExitVault/updateAccountDebt and noticed the else-branch require forces exactly zero, which a positive post-liquidation balance cannot satisfy.
**Insight:** When auditing exit/withdraw flows, trace the residual balance variable through every internal call and check whether the terminal require can be satisfied by all reachable states—especially positive balances created by liquidation or interest accrual.