# claimRedemption() Rounds Up amountTransmuted

Transmuter.claimRedemption() integer division rounds amountNottransmuted down, rounding amountTransmuted up, overpaying yield tokens on early redemptions and risking under-collateralization.

- Payout: Contest reward
- Severity: medium
- Program: Alchemix
- Credited: kvar
- Disclosed: 2025-07-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.2.13
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.13
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Transmuter.sol claimRedemption() smart contract
**Root cause:** amountNottransmuted = position.amount * blocksLeft / transmutationTime uses integer division that truncates, so amountTransmuted = position.amount - amountNottransmuted is rounded up, redeeming slightly more yield tokens than earmarked.
**Steps:**
1. Deploy/fork at block 21835200 with AlchemistV3.t.sol harness.
2. As 0xbeef: approve fakeYieldToken, `alchemist.deposit(100e18, 0xbeef, 0)`.
3. Get tokenId via AlchemistNFTHelper, `alchemist.mint(tokenId, 80e18, 0xbeef)`.
4. Approve alToken to transmuterLogic, call `createRedemption(1e18)` three times.
5. `vm.roll(block.number + 1)` then `claimRedemption(1..3)` early.
6. Last claim reverts in PositionDecay.WeightIncrement() because redeem amount exceeds earmarked total (`require(increment <= total)`).
**How found:** Code review of the redemption math: noticed integer division on amountNottransmuted truncates, inverting the intended rounding on amountTransmuted; confirmed via a forge test that early claims revert on the earmark check.
**Exploitation:** Repeated early claims each round amountTransmuted up by a fraction of a wei-equivalent, cumulatively redeeming more yield tokens than earmarked; over time drains earmarked collateral leading to systemic under-collateralization.
**Escalation:** Accumulation across many users claiming just after a block boundary amplifies the rounding leak toward protocol insolvency.
**Insight:** In share/redemption accounting, subtraction of a truncated quotient flips rounding direction—audit any `total - (x*y/z)` pattern for upward rounding that favors the claimant, and test claims at block boundaries where blocksLeft is maximal.