# Missing update in _sync() causes users funds to get stuck

AlchemistV3._sync() reduces rawLocked after redemption but never increases freeCollateral, permanently locking users' leftover collateral with no sweep function.

- Payout: Contest reward
- Severity: high
- Program: Alchemix
- Credited: falconhoof
- Disclosed: 2025-07-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.1.18
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.18
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** AlchemistV3.sol smart contract _sync() accounting
**Root cause:** _sync() decrements account.rawLocked by collateralToRemove after redemptions but fails to increment account.freeCollateral by the same amount, so freeCollateral understates available collateral.
**Steps:**
1. Deposit collateral and mint max borrowable debt for tokenId 1 as debtor
2. As redeemer, approve alToken and call `transmuterLogic.createRedemption(maxBorrowable)`
3. Advance blocks (`vm.roll(block.number + 5_256_000)`) and call `transmuterLogic.claimRedemption(1)`
4. Observe getCDP shows debt≈0, earmarked≈0, collateral>0
5. Call `alchemist.withdraw(collateral, debtor, tokenId)` — reverts because freeCollateral was never increased
**How found:** Code review of _sync() accounting: noticed rawLocked was decremented but freeCollateral was not updated alongside it, then wrote a Foundry test to confirm withdraw reverts after full redemption.
**Exploitation:** Any user whose debt is fully repaid via redemptions ends with collateral still in the contract but freeCollateral too low to withdraw; no sweep function exists so funds are permanently stuck.
**Insight:** When auditing accounting sync functions, diff every mutated balance field against its paired counterpart (locked vs free, debt vs earmarked); a decrement without a matching increment on the free/available side silently strands user funds.