# Synthetix Logic Error Bugfix Review

Synthetix _exchange used pre-settlement sourceAmount instead of sourceAmountAfterSettlement, letting users reclaim rebates then exchange to mint inflated destination synths.

- Payout: $100,000
- Severity: critical
- Program: Synthetix
- Found by: thunderdeep14
- Disclosed: 2022-07-06
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/synthetix-logic-error-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-synthetix-logic-error-bugfix-review
- Tags: area:web3 domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** Synthetix exchange/rebate settlement logic (SIP-236 fee reclamation)
**Root cause:** In _exchange, effectiveValueAndRatesAtRound is called with sourceAmount instead of sourceAmountAfterSettlement, so destinationAmount is computed from the full pre-rebate amount while only the settled amount is burned.
**Steps:**
1. User exchanges sUSD to sBTC; destination price drops during the cooldown window, creating an owed rebate in sBTC.
2. User calls exchange again before reclaiming the rebate, so sourceAmount is inflated by the unsettled rebate.
3. entry.destinationAmount is computed at L442 via effectiveValueAndRatesAtRound using sourceAmount (not sourceAmountAfterSettlement).
4. amountReceived = _deductFeesFromAmount(entry.destinationAmount, entry.exchangeFeeRate) at L486 issues the inflated amount.
5. _convert burns only sourceAmountAfterSettlement, so the user receives more destination synth than burned.
**How found:** Reviewer traced SIP-236 rebate math and noticed _exchange computed destinationAmount from sourceAmount rather than sourceAmountAfterSettlement, meaning no post-reclaim accuracy check existed.
**Exploitation:** Attacker waits for a destination-price drop during the fee-reclamation cooldown, then exchanges before reclaiming the rebate so the full pre-settlement sourceAmount drives amountReceived while only the settled amount is burned, netting extra destination synths.
**Insight:** In fee-reclamation/rebate designs, check every downstream calculation uses the post-settlement amount, not the pre-settlement input; ordering exchange before reclaim is the exploitable window.