# Fenwick Tree Query Allows Incorrect Stake Values

Fenwick tree query over uninitialized branches returns negative stake values, causing uint256 cast revert and DoS in Alchemix liquidations.

- Payout: Contest reward
- Severity: medium
- Program: Alchemix
- Credited: silverologist
- Disclosed: 2025-07-15
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.4
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** StakingGraph Fenwick tree library (queryStake/queryGraph)
**Root cause:** When graph size grows, the rightmost level-1 node is copied to new level-1 nodes only on the next addStake; queries whose end index falls in an uninitialized branch compute a negative delta, yielding a negative stake value.
**Steps:**
1. Call `graph.addStake(100, 25, 3)` so graph.size becomes 32.
2. Query `graph.queryStake(63, 63)`: start branch 32 is initialized, end branch 64 is not.
3. Observe result `-300` instead of 0.
4. In queryGraph, `(queried / BLOCK_SCALING_FACTOR).toUint256()` reverts on the negative value.
5. Revert propagates through `_earmark` into AlchemistV3 functions including liquidations until a new stake initializes the end branch.
**How found:** Code review of the Fenwick tree growth logic: noticed the rightmost level-1 node is only propagated to new nodes during addStake, hypothesized queries spanning uninitialized branches would compute wrong deltas, and confirmed with a Foundry PoC showing -300.
**Exploitation:** Attacker (or any user) triggers a stake query whose range end lands in an uninitialized Fenwick branch, causing queryGraph to revert; since _earmark is used by liquidations and other core AlchemistV3 paths, liquidations are blocked until a new stake initializes the branch.
**Insight:** In Fenwick/segment-tree stake accounting, check the window between graph growth and node initialization: any query whose end index lands in a not-yet-propagated branch can produce negative deltas that revert on uint256 casts, so audit lazy-initialization boundaries for DoS on liquidation paths.