# Attacker can utilize function CdpManager.redeemCollateral() to break the order of sortedCdps

redeemCollateral reinserts a partially redeemed CDP before batch-removing fully redeemed ones, letting crafted hints corrupt SortedCdps ordering.

- Payout: Contest reward
- Severity: medium
- Program: eBTC Protocol
- Credited: TrungOre
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-badger-findings/issues/173
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-badger%3AM-03
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic

**Target:** CdpManager.redeemCollateral / SortedCdps linked list
**Root cause:** Partially redeemed CDP is reinserted into SortedCdps inside the redemption loop while fully redeemed CDPs are only batch-removed afterward, so the reinsertion uses stale neighbors and attacker-supplied upper/lower hints.
**Steps:**
1. Call `redeemCollateral` with `_upperPartialRedemptionHint`/`_lowerPartialRedemptionHint` crafted so the partially redeemed CDP is reinserted at a wrong position.
2. Ensure the loop fully redeems one or more CDPs (left in list with NICR=type(uint256).max) and partially redeems another.
3. After the loop, `sortedCdps.batchRemove` removes the fully redeemed IDs, leaving the partial CDP misplaced.
4. Optionally size the partial redemption to leave debt=1 so new NICR is huge, worsening misordering.
5. Open new CDPs with dummy upper hints to propagate incorrect positions.
**How found:** Code reading of redeemCollateral loop: noticed _closeCdpByRedemption zeroes debt/coll but does not remove from SortedCdps, while partial redemption reinserts immediately, so reinsertion happens before batchRemove.
**Exploitation:** Attacker supplies malicious partial redemption hints during redeemCollateral; the partial CDP is reinserted relative to not-yet-removed fully redeemed nodes, breaking sort order. Repeated opens with dummy hints propagate misordering and can force high-NICR CDPs to be redeemed first.
**Escalation:** Front-running user openCdp transactions with dummy hints to push their CDPs into redeemable positions; scaling incorrect positions via many openCdp calls.
**Insight:** When a loop defers batch removal of list nodes but reinserts a modified node mid-loop, the reinsertion sees stale neighbors; test hint-dependent reinsertion against deferred deletions.