# It may be possible to liquidate on behalf of another account

VaultLiquidationAction skips liquidator validation when msg.sender is the vault, letting anyone force a user who approved Notional to deleverage an account.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: ShadowForce
- Disclosed: 2023-03-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-notional-judging/issues/215
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AM-21
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** VaultLiquidationAction._authenticateDeleverage / BaseStrategyVault
**Root cause:** When ONLY_VAULT_DELEVERAGE flag is set, _authenticateDeleverage only checks msg.sender == vault and never validates the liquidator parameter, so the vault's own call can pass any arbitrary liquidator address.
**Steps:**
1. User approves Notional contracts for funds.
2. Attacker calls the vault's deleverage entrypoint so msg.sender == vault.
3. Pass victim's address as `liquidator` in the action params.
4. Vault passes ONLY_VAULT_DELEVERAGE check (msg.sender == vault) without sanitizing liquidator.
5. Victim is forced to purchase vault shares / deleverage an account they did not choose.
**How found:** Code review of _authenticateDeleverage authorization branches: noticed the ONLY_VAULT_DELEVERAGE path checks only msg.sender == vault and never validates the liquidator argument, unlike the else branch requiring msg.sender == liquidator.
**Exploitation:** Attacker routes the deleverage call through the vault itself (msg.sender == vault) and supplies an arbitrary approved user as `liquidator`, forcing that user to take on the deleverage/liquidation position.
**Insight:** In dual-authorization branches, check whether the privileged branch (msg.sender == vault) still validates all user-supplied role parameters like liquidator; a missing check there lets the trusted caller be used as a proxy to force actions on approved users.