# Redemption Sandwich Attack Enables CDP Owners to Evade Proportional Collateral Reduc- tion

Missing time-lock on debt burning lets a CDP owner front-run a pending redemption, burn debt to lower rawLocked, then re-borrow, dodging their share of collateral reduction.

- Payout: Contest reward
- Severity: medium
- Program: Alchemix
- Credited: CAUsr
- Disclosed: 2025-07-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.2.21
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.21
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:race-condition

**Target:** AlchemistV3.sol debt burn / redeem flow
**Root cause:** Debt burning has no time-lock, so a borrower can burn and re-mint debt within the same block, manipulating rawLocked/totalLocked at redemption time.
**Steps:**
1. Spot a significant `redeem` transaction in the mempool.
2. Front-run it with a debt repay/burn, lowering `totalLocked`/`rawLocked`.
3. Let the redemption execute against the reduced locked value.
4. Borrow back the debt in the same block (burn-then-mint allowed same block).
**How found:** Code review of AlchemistV3.sol#L447 noting no time-lock on debt burning and that burn-then-mint is permitted in the same block, enabling a sandwich around redeem.
**Exploitation:** Attacker monitors mempool for large redemptions, front-runs by burning their debt to shrink rawLocked so the redemption's proportional collateral reduction is distributed onto other CDPs, then re-borrows after the redemption settles. Only cost is the debt burning fee.
**Insight:** When a redemption distributes losses proportionally to a locked-value snapshot, check whether a participant can cheaply shrink their own weight in that snapshot within the same block (burn/re-mint asymmetry) to shift losses onto others.