# Disrupted accounting and loss of funds whenever a redemption is made while transmuter holds yieldToken

Transmuter burns full amountTransmuted but only decrements totalSyntheticsIssued by amountToRedeem, inflating badDebtRatio and underpaying redeemers.

- Payout: Contest reward
- Severity: high
- Program: Alchemix
- Credited: armormadeofwoe
- Disclosed: 2025-07-15
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.1.13
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.13
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Transmuter.sol redemption logic
**Root cause:** alchemist.redeem(amountToRedeem) decrements totalSyntheticsIssued by the partial amount while safeBurn(syntheticToken, amountTransmuted) burns the full amount, so the two diverge whenever the transmuter holds yieldToken.
**Steps:**
1. Liquidations/repayments transfer yieldToken into Transmuter, so yieldTokenBalance > 0.
2. User claims redemption of amountTransmuted synths.
3. Code computes debtValue from yieldTokenBalance and amountToRedeem = amountTransmuted - debtValue.
4. alchemist.redeem(amountToRedeem) reduces totalSyntheticsIssued by only amountToRedeem.
5. safeBurn(syntheticToken, amountTransmuted) burns the full amountTransmuted.
6. totalSyntheticsIssued stays inflated relative to actual supply.
7. badDebtRatio = totalSyntheticsIssued * 10^decimals / getTotalUnderlyingValue() exceeds 1e18, triggering false-positive bad debt and scaling down claimAmount/feeAmount.
**How found:** Code-reading of redeem: noticed safeBurn uses amountTransmuted while alchemist.redeem uses the partial amountToRedeem, then traced totalSyntheticsIssued into the badDebtRatio calculation.
**Exploitation:** Repeated redemptions while the transmuter holds yieldToken permanently inflate totalSyntheticsIssued; once badDebtRatio > 1e18, all redeemers' claimAmount and feeAmount are scaled down by FIXED_POINT_SCALAR/badDebtRatio, causing loss of funds to users.
**Escalation:** Inflation is cumulative across redemptions, so the ratio drifts further past 1e18 over time, worsening underpayment.
**Insight:** When a function both burns tokens and calls an external accounting update, verify both use the same quantity; partial-vs-full amount mismatches silently corrupt global supply counters that gate payout ratios.