# Incorrect management of redemption weight

AlchemistV3 redemption weight saturates to infinity after full earmark redemption, letting later partial redemptions over-credit redeemable amount and wrongly reduce user debt.

- Payout: Contest reward
- Severity: high
- Program: Alchemix
- Credited: ZoA
- Disclosed: 2025-07-15
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.1.7
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.7
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AlchemistV3 / TransmuterLogic redemption accounting
**Root cause:** When amount equals cumulativeEarmarked, _redemptionWeight is bumped by LOG2NEGFRAC_1+1 (treated as infinite) and never reset, so subsequent partial redemptions compute redeemable amount as the full earmarked total.
**Steps:**
1. Deposit collateral and mint alUSD via `alchemist.mint(tokenId, 10_000e18, ...)`.
2. As alUSD holder: `transmuterLogic.createRedemption(1000e18)`, roll past transmutation period, `claimRedemption(1)` — sets `_redemptionWeight = 0x800... + 1` (infinite).
3. Create redemption for 1000e18, roll half period, create another 1000e18, roll half period + 1.
4. `claimRedemption(2)` adds `-Log2(500/2000)=2` to the already-infinite weight.
5. Observe `getCDP`: debt ≈ 10_000e18 - 2_500e18 while only 2_000e18 is redeemable; earmarked = 0.
**How found:** Code-reading of AlchemistV3.redeem: noticed the amount==cumulativeEarmarked branch adds LOG2NEGFRAC_1+1 (infinite sentinel) and hypothesized the weight is never reset, then built a Foundry PoC with sequential redemptions to confirm debt over-reduction.
**Exploitation:** Attacker first fully redeems an earmarked amount to saturate _redemptionWeight to infinity, then makes staggered partial redemptions so the redeemable amount is computed as the entire earmarked total rather than the proportional share, reducing their CDP debt beyond what they actually redeemed.
**Insight:** Sentinel 'infinite' values written into accumulator state are a classic saturation bug: check whether the sentinel is ever cleared before later increments, and test sequences where a full redemption is followed by partial ones.