# Alchemix Missing Solvency Check Bugfix Review

Alchemix liquidate() lacked a post-liquidation solvency check, letting a borrower sandwich their own unwrap with minimumAmountOut=0 to leave bad debt and mint ~7k unbacked alETH.

- Payout: $116,513
- Severity: critical
- Program: Alchemix
- Credited: Koiush
- Disclosed: 2023-11-30
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/alchemix-missing-solvency-check-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-alchemix-missing-solvency-check-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:reverse-engineering technique:source-review vuln:accounting-error vuln:business-logic vuln:flash-loan vuln:liquidation vuln:oracle-manipulation

**Target:** AlchemistV2.sol liquidate() / rETH TokenAdapter unwrap via Balancer
**Root cause:** liquidate() unwraps collateral via a Balancer swap honoring user-supplied minimumAmountOut but never calls _validate() afterward, so a self-sandwiched unwrap returning near-zero underlying leaves debt unpaid while collateral is drained.
**Steps:**
1. Deposit rETH collateral and mint alETH up to 50% LTV.
2. Manipulate the rETH/WETH Balancer pool rate up via a large swap.
3. Call `liquidate(rETH, shares, 0)` so the unwrap swap is sandwiched to return ~0 underlying.
4. Repeat liquidations until collateral value is near zero, leaving bad debt.
5. Swap back on Balancer to restore pool rate and recover deposited collateral.
6. Repeat across ~20 accounts to bypass per-account deposit limits.
**How found:** Researcher read private _yieldTokens storage via cast storage to locate the rETH adapter, decompiled it with Dedaub to see the Balancer swap, and noticed minimumAmountOut=0 plus no post-liquidation solvency check enables self-sandwiching.
**Exploitation:** Attacker needs significant upfront capital (no flash loan). Manipulate Balancer rETH/WETH rate, deposit to limit, mint max alETH, self-sandwich liquidate with minimumAmountOut=0 so unwrap yields ~0, repeat until collateral drained, restore pool rate, keep minted alETH minus swap fees. ~3000 alETH/hour, ~7k alETH ($11.6M) in 2 hours.
**Escalation:** Scaling across 20 disposable accounts to bypass deposit/mint limits; repeated cycles to accumulate unbacked alETH.
**Insight:** In liquidation flows, check whether the protocol re-validates solvency after the swap; a user-controlled minimumAmountOut combined with a missing post-swap _validate lets a borrower self-sandwich to shed debt while keeping collateral. Read private storage slots to find adapter contracts and decompile them.