# transmuter.totalLocked() can be manipulated DoSing some function in the AlchemistV3 con- tract

Transmuter.totalLocked() can be inflated by creating and claiming a redemption in one block, DoSing AlchemistV3 burn and setTransmuter.

- Payout: Contest reward
- Severity: medium
- Program: Alchemix
- Credited: TamayoNft
- Disclosed: 2025-07-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.2.5
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:dos

**Target:** AlchemistV3 / Transmuter redemption accounting
**Root cause:** totalLocked() reflects pending redemption state that any user can inflate by creating a redemption; AlchemistV3 burn and setTransmuter read it as a hard invariant check.
**Steps:**
1. Attacker deposits yield tokens into AlchemistV3 and mints alTokens.
2. Attacker approves alToken to transmuter and calls `createRedemption(50e18)` to raise totalLocked().
3. Admin calls `setTransmuter(newAddr)`; the require `convertYieldTokensToDebt(balanceOf(yieldToken, transmuter)) >= ITransmuter(transmuter).totalLocked()` reverts.
4. Same manipulation makes `burn()` revert via `credit > totalDebt - totalLocked()`.
**How found:** Code review of AlchemistV3 invariant checks that call ITransmuter(transmuter).totalLocked(), noticing the value is user-controllable via createRedemption.
**Exploitation:** Front-run the admin's setTransmuter or a user's burn by creating a redemption in the same block/timestamp, inflating totalLocked() so the invariant check fails and the call reverts.
**Insight:** When a contract reads a mutable external accounting value (totalLocked) as a hard invariant, check whether any user action can move that value within the same block to grief admin or user calls.