# Possible reentrancy during redemption/swap

Reentrancy via ERC777 collateral callback during Transmuter redeem lets attacker re-enter before all collaterals transfer, skewing curve and extracting extra collateral.

- Payout: Contest reward
- Severity: high
- Program: Angle Protocol
- Credited: auditor0517
- Disclosed: 2023-08-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-06-angle-findings/issues/24
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-angle%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reentrancy

**Target:** Transmuter Redeemer.sol redeem/swap
**Root cause:** _redeem burns agToken and transfers collaterals in a loop without a reentrancy guard; an ERC777 collateral transfer invokes a recipient hook mid-loop, so a reentrant redeem quotes against a partially-updated collateral state.
**Steps:**
1. Deploy attacker contract holding 20 agToken; collaterals colA (ERC777) and colB, 1000 each in Transmuter.
2. Call `redeem(10)` — quote returns 10 colA + 10 colB.
3. During colA `safeTransfer` hook, re-enter `redeem(10)`; state now colA=990, colB=1000 (colB not yet sent).
4. Second redemption quotes against skewed ratio, yielding more collateral than entitled.
5. Repeat/scale to drain excess collateral.
**How found:** Code review of _redeem loop: noticed collateral transfers occur before loop completion and that ERC777/LibManager.release can invoke recipient callbacks, hypothesizing a mid-loop reentrancy skews _quoteRedemptionCurve.
**Exploitation:** Attacker registers an ERC777-style collateral recipient hook; on first redeem the hook re-enters redeem before colB is transferred, so the second quote uses an imbalanced collateral ratio and overpays the attacker in collateral.
**Insight:** In multi-collateral redemption loops, any external transfer (ERC777 hooks, managed release) before the loop finishes leaves state inconsistent; check whether the quote function reads live balances that a reentrant call can observe mid-transfer.