# Prioritization of Earmarked Debt in repay Leads to Skewed Redemption Exposure and Un- closeable CDPs

AlchemistV3.repay wipes earmarked debt first, so later redemptions cut collateral without reducing debt, leaving CDPs undercollateralized and unliquidatable via underflow.

- Payout: Contest reward
- Severity: high
- Program: Alchemix
- Credited: CAUsr
- Disclosed: 2025-07-15
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.1.16
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.16
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** AlchemistV3.sol repay / Transmuter redemption logic
**Root cause:** repay reduces account.earmarked before regular debt, so earmarked debt that governs redemption debt-reduction is depleted prematurely; subsequent redemptions reduce rawLocked collateral without proportional debt reduction.
**Steps:**
1. Create two CDPs via `makePosition` (deposit 100e18, mint 50% debt).
2. Have 0xbeef call `transmuterLogic.createRedemption(debtChunk)` to create earmarked debt on both CDPs.
3. `alchemist.poke` both CDPs to sync earmarked amounts.
4. externalUser calls `alchemist.repay(convertDebtTokensToYield(debtChunk/2), tokenId)` — earmarked drops to 0 while debt stays 2.5e19.
5. 0xbeef calls `transmuterLogic.claimRedemption(1)`; externalUser collateral drops ~30% with debt unchanged.
6. `alchemist.liquidate(tokenIdForExternalUser)` reverts with arithmetic underflow.
**How found:** Code review of repay noticed earmarked is decremented before regular debt; traced how earmarked drives redemption debt-reduction and hypothesized collateral/debt divergence, confirmed with a forge PoC.
**Exploitation:** Any CDP holder repays debt; earmarked bucket is zeroed first. A third party then claims a Transmuter redemption, which reduces the victim CDP's locked collateral without reducing debt, pushing it underwater. Liquidation reverts on rawLocked underflow, so the position is stuck and collateral is effectively locked.
**Escalation:** Adding collateral/debt does not help since new debt adds to rawLocked pro rata, permanently bricking the CDP.
**Insight:** When a protocol tracks a separate 'earmarked' debt bucket that gates how third-party redemptions reduce debt, check every path that mutates that bucket (repay, forceRepay) for ordering that can zero it out of proportion to total debt — then test whether redemptions can strip collateral while debt stays fixed.