# Custom redemption can be used to get more than RToken value, when an upwards depeg occurs

Custom redemption lets an attacker redeem RToken for a mix including a previous basket holding an upward-depegged collateral worth more than target, capturing revenue-trader funds.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: 0xA5DF
- Disclosed: 2023-11-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-reserve-findings/issues/6
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** RToken custom redemption / BasketHandler (Solidity contracts)
**Root cause:** Custom redemption assumes previous baskets aren't worth more than target value, but a previous basket can contain collateral that depegged upwards and is now worth more than its peg; redemption doesn't check collateral is SOUND or price vs peg.
**Steps:**
1. Basket contains token X pegged to c; X depegs upward to 2c.
2. After delayUntilDefault, collateral becomes IFFY then DISABLED; anyone calls refreshBasket(), token Y becomes backup.
3. Half of X traded for Y; other half should go to revenue traders via forwardRevenue.
4. Before forwardRevenue, attacker calls custom redemption mixing half current basket and half previous basket.
5. Attacker receives 0.5X+0.5Y per RToken, worth 1.5c instead of 1c.
**How found:** Code reading of FiatCollateral depeg handling and RToken custom redemption; observed that redemption only checks fullyCollateralized(), not isReady(), and that previous baskets can hold upward-depegged collateral worth more than target.
**Exploitation:** Attacker front-runs forwardRevenue by calling custom redemption with a mix of current and previous basket shares, extracting the upward-depegged collateral value that should have gone to RSR traders and Furnace.
**Insight:** In basket/redemption protocols, check whether redemption paths validate collateral status (SOUND/ready) and price-vs-peg; upward depegs create value leakage when old baskets remain redeemable before revenue is forwarded.