It is possible to slash account balance to zero which deletes a positive ref count account

[xlc]

slash does not respect allow_death check and can kill an account even it still have a positive ref count

substrate/frame/balances/src/lib.rs

Lines 1004 to 1012 in acca0ad

	fn slash(
	who: &T::AccountId,
	value: Self::Balance
	) -> (Self::NegativeImbalance, Self::Balance) {
	if value.is_zero() { return (NegativeImbalance::zero(), Zero::zero()) }
	Self::mutate_account(who, |account| {
	let free_slash = cmp::min(account.free, value);
	account.free -= free_slash;

ref count is not checked when maybe_data is None

substrate/frame/system/src/lib.rs

Lines 1320 to 1324 in acca0ad

	*maybe_value = maybe_data.map(|data| {
	let (nonce, refcount) = maybe_prefix.unwrap_or_default();
	AccountInfo { nonce, refcount, data }
	});
	(existed, maybe_value.is_some(), result)

Should have some debugging warnings like

substrate/frame/system/src/lib.rs

Lines 1219 to 1224 in acca0ad

	if account.refcount > 0 {
	debug::debug!(
	target: "system",
	"WARNING: Referenced account deleted. This is probably a bug."
	);
	}