# Liquidation will fail due to underflow if user collateral is not enough to cover earmark debt

Underflow in _forceRepay when collateral is less than earmarked debt reverts liquidation, leaving bad-debt positions unliquidatable.

- Payout: Contest reward
- Severity: medium
- Program: Alchemix
- Credited: montecristo
- Disclosed: 2025-07-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.2.11
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.11
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:liquidation

**Target:** AlchemistV3.liquidate / _forceRepay
**Root cause:** _forceRepay subtracts creditToYield from account.collateralBalance without clamping, so when earmarked debt exceeds collateral the subtraction underflows and reverts.
**Steps:**
1. Deploy AlchemistV3 with Transmuter, deposit 100 yield tokens as alice
2. Mint 90 debt tokens against the position
3. Create a 90-token redemption in Transmuter to earmark debt
4. Roll forward past timeToTransmute so earmarked equals full debt
5. Drop collateral price ~15% so collateral < earmarked debt
6. Call `alchemist.liquidate(alicePositionId)` -> reverts with arithmetic underflow
**How found:** Code reading of the liquidation path: noticed _forceRepay clears earmarked and decrements collateralBalance unconditionally, hypothesized underflow when collateral < earmarked, confirmed with a Foundry PoC.
**Exploitation:** Liquidation is blocked entirely; a position whose collateral fell below its earmarked debt cannot be liquidated, leaving bad debt in the protocol. Requires large earmarked debt plus severe price drop.
**Insight:** In liquidation paths that pre-repay earmarked/queued debt, check that collateral decrements are clamped to balance; earmarked debt can exceed collateral after price drops, turning accounting subtraction into a liquidation DoS.