# Single-sided instead of proportional exit is performed during emergency exit

Notional's emergencyExit passed isSingleSided=true, forcing single-asset Balancer/Curve exits instead of proportional, causing slippage and front-run losses during emergency exit and vault restoration.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2023-10-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-notional-judging/issues/87
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Leveraged vault emergency exit (Balancer/Curve LP unstake)
**Root cause:** emergencyExit calls _unstakeAndExitPool with isSingleSided=true, so Balancer uses EXACT_BPT_IN_FOR_ONE_TOKEN_OUT and Curve uses remove_liquidity_one_coin instead of proportional exit, contradicting the documented intent.
**Steps:**
1. Call `emergencyExit(claimToExit)` as EMERGENCY_EXIT_ROLE on SingleSidedLPVaultBase
2. Observe `_unstakeAndExitPool(claimToExit, new uint256[](NUM_TOKENS()), true)` passes isSingleSided=true
3. In BalancerComposableAuraVault, customData encodes `EXACT_BPT_IN_FOR_ONE_TOKEN_OUT` with primaryIndex
4. In Curve2TokenConvexVault, `pool.remove_liquidity_one_coin(poolClaim, _PRIMARY_INDEX, minAmounts)` is used
5. Result: only one pool token received, incurring internal swap slippage and front-run exposure
**How found:** Code review comparing the emergencyExit doc comment ('withdrawn proportionally to the underlying tokens') against the actual call passing isSingleSided=true, then tracing into Balancer and Curve _unstakeAndExitPool implementations.
**Exploitation:** Emergency exit role triggers exit; single-sided redemption swaps internally within the pool, exposing the exit to front-running and slippage, and leaves vault holding one token requiring costly re-entry.
**Insight:** When a function's NatSpec promises proportional behavior, verify the boolean/flag actually passed to the downstream exit/join helper — a single flipped flag silently changes Balancer exit kind and Curve remove_liquidity variant, introducing slippage and front-run risk.