# _liquidate function fails to adjust adjustedDebtToBurn resulting is using someone else's col- lateral to pay for the liquidation

AlchemistV3 _liquidate transfers unadjusted adjustedDebtToBurn to transmuter, draining other users' collateral when a position's debt exceeds its own collateral.

- Payout: Contest reward
- Severity: high
- Program: Alchemix
- Credited: touthang
- Disclosed: 2025-07-15
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.1.17
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.17
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** AlchemistV3 _liquidate / Transmuter transfer
**Root cause:** _liquidate clamps account.collateralBalance to zero but still transfers the full adjustedDebtToBurn (converted debtToBurn) to the transmuter, so the shortfall is paid from the contract's pooled yield tokens belonging to other depositors.
**Steps:**
1. Deploy AlchemistV3 with mock ERC4626 yield token, minimumCollateralization 1.5e18, lower bound 1.2e18.
2. Provider deposits 1,000,000 underlying; Bob deposits 150 yield and mints 100 debt.
3. Drop yield token value ~50% via `withdrawToDecreaseTokenValue(500_000 ether, address(1))`.
4. Call `alchemist.liquidate(1)` — reverts when contract lacks extra collateral.
5. Other user deposits 100 yield (position 2); call `alchemist.liquidate(1)` again — succeeds, consuming other user's tokens.
6. Other user's `withdraw(100 ether, otherUsers, 2)` now reverts; contract balance shows 50e18 drained.
**How found:** Code review of _liquidate: noticed collateralBalance is clamped with a ternary but adjustedDebtToBurn passed to safeTransfer is not, then built a Foundry PoC halving yield token value to force the shortfall.
**Exploitation:** Any liquidator calls liquidate on an underwater position whose converted debtToBurn exceeds its collateralBalance; the excess is silently pulled from pooled yield tokens deposited by unrelated users, making their withdrawals fail.
**Insight:** In liquidation paths, audit every value sent out against the clamped/updated user balance — a ternary clamp on one variable often leaves a sibling transfer amount unclamped, letting the pool subsidize the shortfall.