# Incorrect bad debt ratio calculation

Transmuter's bad debt ratio divides synthetics by Alchemist's yield balance, ignoring yield tokens sent to Transmuter during liquidations, inflating the ratio and shorting redemption claimers.

- Payout: Contest reward
- Severity: high
- Program: Alchemix
- Credited: montecristo
- Disclosed: 2025-07-15
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.1.8
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.1.8
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Transmuter.sol bad debt ratio / AlchemistV3 liquidation
**Root cause:** badDebtRatio uses alchemist.getTotalUnderlyingValue() (Alchemist's yield balance) as denominator, but liquidations transfer yield tokens out of Alchemist to Transmuter, shrinking the denominator without reducing totalSyntheticsIssued.
**Steps:**
1. Deploy AlchemistV3 + Transmuter with mock yield token; alice deposits 100, mints 90 debt; bob deposits 100, mints 50 debt
2. Drop yield token price ~7% (`_adjustPrice(-700)`) so alice is liquidatable
3. Compute badDebtRatio = totalSyntheticsIssued * 10**decimals / getTotalUnderlyingValue() -> ~0.749
4. Call `alchemist.liquidate(alicePositionId)`; liquidation transfers adjustedDebtToBurn yield tokens to Transmuter (AlchemistV3.sol:826-827)
5. Recompute ratio -> ~1.102, exceeding 1e18 despite alice having no bad debt
**How found:** Reviewed the three debt-repayment paths (yield-token repayment, debt-token burn, liquidation) and tracked how each affects totalSyntheticsIssued vs Alchemist's yield balance; noticed liquidation uniquely decreases the denominator while leaving synthetics unchanged, then confirmed with a Foundry PoC.
**Exploitation:** Every liquidation (even healthy, non-bad-debt ones) moves yield tokens from Alchemist to Transmuter, inflating badDebtRatio; Transmuter then scales claimAmount and feeAmount down by FIXED_POINT_SCALAR/badDebtRatio, so redemption claimers receive less yield than owed, depegging AlTokens.
**Insight:** When auditing ratio/health formulas, enumerate every state-mutating path (repay, burn, liquidate) and check whether numerator and denominator move consistently; asset transfers to a sibling contract that the formula ignores are a classic denominator-skew bug.