It may be possible to liquidate on behalf of another account
If the caller of any liquidation action is the vault itself, there is no validation of the `liquidator` parameter and therefore, any arbitrary account may act as the `liquidator` if they have approved any amount of funds for the `VaultLiquidationAction.sol` contract.\\nWhile the vault implementation itself should most likely handle proper validation of the parameters provided to actions enabled by the vault, the majority of important validation should be done within the Notional protocol. The base implementation for vaults does not seem to sanitise `liquidator` and hence users could deleverage accounts on behalf of a `liquidator` which has approved Notional's contracts.\\n```\\nFile: VaultLiquidationAction.sol\\n    function _authenticateDeleverage(\\n        address account,\\n        address vault,\\n        address liquidator\\n    ) private returns (\\n        VaultConfig memory vaultConfig,\\n        VaultAccount memory vaultAccount,\\n        VaultState memory vaultState\\n    ) {\\n        // Do not allow invalid accounts to liquidate\\n        requireValidAccount(liquidator);\\n        require(liquidator != vault);\\n\\n        // Cannot liquidate self, if a vault needs to deleverage itself as a whole it has other methods \\n        // in VaultAction to do so.\\n        require(account != msg.sender);\\n        require(account != liquidator);\\n\\n        vaultConfig = VaultConfiguration.getVaultConfigStateful(vault);\\n        require(vaultConfig.getFlag(VaultConfiguration.DISABLE_DELEVERAGE) == false);\\n\\n        // Authorization rules for deleveraging\\n        if (vaultConfig.getFlag(VaultConfiguration.ONLY_VAULT_DELEVERAGE)) {\\n            require(msg.sender == vault);\\n        } else {\\n            require(msg.sender == liquidator);\\n        }\\n\\n        vaultAccount = VaultAccountLib.getVaultAccount(account, vaultConfig);\\n\\n        // Vault accounts that are not settled must be settled first by calling settleVaultAccount\\n        // before liquidation. settleVaultAccount is not permissioned so anyone may settle the account.\\n        require(block.timestamp < vaultAccount.maturity, "Must Settle");\\n\\n        if (vaultAccount.maturity == Constants.PRIME_CASH_VAULT_MATURITY) {\\n            // Returns the updated prime vault state\\n            vaultState = vaultAccount.accruePrimeCashFeesToDebtInLiquidation(vaultConfig);\\n        } else {\\n            vaultState = VaultStateLib.getVaultState(vaultConfig, vaultAccount.maturity);\\n        }\\n    }\\n```\\n
Make the necessary changes to `BaseStrategyVault.sol` or `_authenticateDeleverage()`, whichever is preferred.
A user may be forced to liquidate an account they do not wish to purchase vault shares for.
```\\nFile: VaultLiquidationAction.sol\\n    function _authenticateDeleverage(\\n        address account,\\n        address vault,\\n        address liquidator\\n    ) private returns (\\n        VaultConfig memory vaultConfig,\\n        VaultAccount memory vaultAccount,\\n        VaultState memory vaultState\\n    ) {\\n        // Do not allow invalid accounts to liquidate\\n        requireValidAccount(liquidator);\\n        require(liquidator != vault);\\n\\n        // Cannot liquidate self, if a vault needs to deleverage itself as a whole it has other methods \\n        // in VaultAction to do so.\\n        require(account != msg.sender);\\n        require(account != liquidator);\\n\\n        vaultConfig = VaultConfiguration.getVaultConfigStateful(vault);\\n        require(vaultConfig.getFlag(VaultConfiguration.DISABLE_DELEVERAGE) == false);\\n\\n        // Authorization rules for deleveraging\\n        if (vaultConfig.getFlag(VaultConfiguration.ONLY_VAULT_DELEVERAGE)) {\\n            require(msg.sender == vault);\\n        } else {\\n            require(msg.sender == liquidator);\\n        }\\n\\n        vaultAccount = VaultAccountLib.getVaultAccount(account, vaultConfig);\\n\\n        // Vault accounts that are not settled must be settled first by calling settleVaultAccount\\n        // before liquidation. settleVaultAccount is not permissioned so anyone may settle the account.\\n        require(block.timestamp < vaultAccount.maturity, "Must Settle");\\n\\n        if (vaultAccount.maturity == Constants.PRIME_CASH_VAULT_MATURITY) {\\n            // Returns the updated prime vault state\\n            vaultState = vaultAccount.accruePrimeCashFeesToDebtInLiquidation(vaultConfig);\\n        } else {\\n            vaultState = VaultStateLib.getVaultState(vaultConfig, vaultAccount.maturity);\\n        }\\n    }\\n```\\n