# Native ETH not received when removing liquidity from Curve V2 pools

Notional's Curve V2 leverage vault called remove_liquidity without use_eth=True, receiving WETH instead of native ETH, breaking redemptions and stranding funds.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2023-10-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-notional-judging/issues/86
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-8
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** Curve2TokenConvexVault / Curve V2 pool liquidity removal
**Root cause:** Curve V2 pools default use_eth=False, wrapping ETH to WETH; Notional's vault only handles native ETH and never set use_eth=True on remove_liquidity/remove_liquidity_one_coin.
**Steps:**
1. Read Curve V2 pool remove_liquidity_one_coin: when use_eth=False and coin==WETH20, it calls WETH.deposit and transfers WETH to caller.
2. Inspect Curve2TokenConvexVault._unstakeAndExitPool: calls pool.remove_liquidity_one_coin(poolClaim, index, minAmount) and pool.remove_liquidity(poolClaim, minAmounts) without use_eth flag.
3. Observe vault is configured with _UNDERLYING_IS_ETH=true and only accounts for native ETH.
4. Trigger redeemFromNotional or emergencyExit; vault receives WETH, then payable(receiver).transfer fails or WETH is stranded.
**How found:** Code review of Curve V2 pool source revealed the default use_eth=False wrapping behavior, then cross-checked Notional's vault call sites and its native-ETH-only accounting assumptions.
**Exploitation:** No attacker action; a functional flaw. On redeem, native ETH transfer reverts because vault holds WETH, blocking user/Notional redemptions. On emergency exit, WETH is stranded since restoration only re-enters native ETH, dropping value per share.
**Insight:** When integrating with AMMs that support both native and wrapped tokens, verify the default branch of the pool's exit function—Curve V2 silently wraps to WETH unless use_eth=True, so vaults assuming native ETH must pass the flag explicitly.