# Debt can be repaid with a depegged underlyingToken, which can be exploited by arbitrageurs and drives the market price of alToken to match the worst depegged underlyingToken

AlchemistV2 repays debt 1:1 against any underlying token, so a depegged token lets arbitrageurs mint alToken, repay cheaply, and drain value.

- Payout: Audit contest
- Severity: medium
- Program: Alchemix
- Found by: WatchPug
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-05-alchemix#m-17
- Library page: http://bugbountylibrary.com/r/c4%3A2022-05-alchemix%3AM-17
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** AlchemistV2 repay() debt normalization
**Root cause:** repay() normalizes underlying token amounts to debt via a fixed conversionFactor, treating the underlying as 1:1 with debt regardless of its market price.
**Steps:**
1. Deposit 100M USDC collateral and mint 75M alUSD at 0.75 ratio
2. Market buy 75M USDT with 67.5M alUSD at $0.9 depeg price
3. Call `repay(USDT, 75M, recipient)` to clear debt 1:1
4. Withdraw the 100M USDC collateral
5. Dump remaining 7.5M alUSD for profit; repeat until alUSD price matches USDT
**How found:** Code review of _normalizeUnderlyingTokensToDebt and repay() revealed debt is reduced by a fixed conversionFactor rather than market price, implying a depeg creates arbitrage.
**Exploitation:** Arbitrageur mints alToken against collateral, buys the depegged underlying on the market at a discount, repays debt 1:1 at face value, withdraws collateral, and sells leftover alToken, repeating until alToken price converges to the depegged asset.
**Escalation:** Repeated cycles drive alToken market price down to match the worst depegged underlying token.
**Insight:** In CDP systems, check whether debt repayment values underlying tokens at a fixed conversion factor instead of oracle/market price; a depeg then becomes a mint-repay-withdraw arbitrage loop.