# User may get less tokens than expected when collateral list order changes

Redeemer.redeem maps minAmountsOut by collateralList index; revoking a collateral reorders the list, so a user's slippage array can silently apply to the wrong tokens.

- Payout: Contest reward
- Severity: medium
- Program: Angle Protocol
- Credited: Lambda
- Disclosed: 2023-08-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-angle-findings/issues/8
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-angle%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Angle Transmuter Redeemer facet / LibSetters collateral management
**Root cause:** revokeCollateral swaps the last element into the removed slot, mutating ts.collateralList order, while Redeemer.redeem interprets minAmountsOut positionally against that list.
**Steps:**
1. System holds collateralList [tokenA, tokenB, tokenC]; user builds minAmountsOut [0, 10000, 100000] expecting tokenC >= 100000.
2. Governance calls LibSetters.revokeCollateral(tokenA), which swaps tokenC into index 0, yielding [tokenC, tokenB].
3. User's tx executes with stale array: index 0 (0) now applies to tokenC, index 1 (10000) to tokenB.
4. Redemption succeeds even if user receives only 50,000 tokenC, violating intended slippage protection.
**How found:** Code reading of LibSetters.revokeCollateral revealed the swap-and-pop reordering of collateralList, then cross-referenced Redeemer.redeem's positional minAmountsOut indexing to spot the mismatch.
**Exploitation:** Not an attacker-driven exploit; a user transaction prepared against a prior collateral ordering executes after a governance revoke, causing unintended slippage acceptance. Requires timing between user tx preparation and collateral revocation.
**Insight:** When a contract stores user-supplied arrays positionally against a mutable on-chain list, check every mutation path (swap-and-pop, removal, addition) for index drift; slippage arrays keyed by index are a classic victim.