# liquidationTarget is not set when removing pool.

removeD3Pool skips setting liquidationTarget, so finishLiquidation cannot balance vault borrow records, blocking pool removal.

- Payout: Contest reward
- Severity: medium
- Program: Dodo
- Credited: Protocol Team
- Disclosed: 2023-06-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-dodo-judging/issues/246
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AM-14
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** D3Vault / D3MM pool removal and liquidation flow
**Root cause:** removeD3Pool calls ID3MM(pool).startLiquidation() directly instead of going through the vault path that computes and stores liquidationTarget, so the vault's borrow accounting has no target to settle against.
**Steps:**
1. Call `removeD3Pool(address)` which invokes `ID3MM(pool).startLiquidation()` directly, skipping liquidationTarget assignment.
2. Run `liquidationByDODO()` to rebalance pool tokens; vault borrow records remain unchanged.
3. Attempt `finishLiquidation()`: it fails/does nothing because liquidationTarget was never set, so vault borrow recording cannot be balanced.
4. `finishPoolRemove()` cannot complete pool removal.
**How found:** Code reading of the remove-pool 3-step flow (removeD3Pool -> liquidationByDODO -> finishPoolRemove) revealed startLiquidation is called directly, bypassing the vault's liquidationTarget setup needed by finishLiquidation.
**Insight:** When a removal/teardown path calls a component's liquidation entrypoint directly rather than the vault's wrapper, check which state (here liquidationTarget) the wrapper sets that the downstream finish step depends on.