# Redemptions are inconsistent with other cdp's operations

eBTC redemptions skip recovery-mode checks applied to other CDP operations, letting a redeemer push the system into undercollateralization/recovery mode.

- Payout: Contest reward
- Severity: medium
- Program: eBTC Protocol
- Credited: 0xRobocop
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-badger-findings/issues/199
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-badger%3AM-02
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** CdpManager redemption logic (eBTC CDP system)
**Root cause:** Redemption only requires system TCR and redeemed CDP ICR above MCR, unlike other CDP operations which forbid actions that trigger or occur during recovery mode. Redeeming a healthy CDP can lower TCR below CCR.
**Steps:**
1. Set BTC/ETH price to 1, open CDPs: A 400 debt/1000 coll, B and C 75 debt/100 coll.
2. Drop price to 0.6 so B and C ICR fall below MCR while A stays healthy.
3. Call `redeemCollateral` for 400 eBTC via `th.redeemCollateralAndGetTxObject`.
4. Redemption consumes A's CDP (only one with ICR>MCR), removing it from sortedCdps.
5. Observe `getSyncedTCR` after redemption drops below CCR, entering recovery mode.
**How found:** Compared redemption rules against other CDP operations (close/decrease collateral) which enforce recovery-mode constraints; noticed redemption only checks TCR/ICR > MCR, then wrote a Foundry/Hardhat PoC to confirm TCR drops into RM.
**Exploitation:** Attacker redeems eBTC against the sole healthy CDP when other CDPs have bad debt, removing the collateral backing system health and pushing TCR into recovery mode, potentially enabling further undercollateralization.
**Insight:** When auditing CDP/stablecoin systems, diff the precondition checks of every state-changing operation (open, close, adjust, redeem, liquidate) — redemption paths often omit recovery-mode guards that other paths enforce, allowing TCR manipulation.