# User can bypass protocolFee using liquidate instead of repay (_forceRepay)

AlchemistV3 _forceRepay (via liquidate) skips protocolFee deduction that repay applies, letting users avoid the fee when earmarked debt exists.

- Payout: Contest reward
- Severity: medium
- Program: Alchemix
- Credited: ZoA
- Disclosed: 2025-07-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** AlchemistV3.sol repay/liquidate/_forceRepay
**Root cause:** repay deducts protocolFee and sends it to protocolFeeReceiver, but _forceRepay (invoked by liquidate when account.earmarked > 0) repays debt without deducting protocolFee.
**Steps:**
1. Deposit collateral and mint alUSD via `alchemist.mint` for a position NFT.
2. Create a transmuter redemption via `transmuterLogic.createRedemption(mintAmount)` to earmark debt.
3. Roll blocks ~60% through transmutation so `earmarked == prevDebt * 60 / 100`.
4. Drop collateralization below lower bound (e.g. raise yield token supply ~5.9%) so position is liquidatable.
5. Call `alchemist.liquidate(tokenId)`; observe `_forceRepay` path repays earmarked debt.
6. Assert `fakeYieldToken.balanceOf(alchemist.protocolFeeReceiver()) == 0` before and after — fee never collected.
**How found:** Code-reading comparison of repay vs _forceRepay: noticed repay transfers protocolFee to protocolFeeReceiver and deducts it, while _forceRepay omits the deduction; traced that liquidate calls _forceRepay when account.earmarked > 0, giving an alternate repayment path.
**Exploitation:** User with an undercollateralized, earmarked position calls liquidate instead of repay; _forceRepay settles the earmarked debt without charging protocolFee, so protocolFeeReceiver loses the fee.
**Insight:** When two code paths settle the same debt (direct repay vs forced repay during liquidation), diff their fee/accounting side effects — alternate entry points often skip fee or accounting steps the primary path enforces.