# Changing transmuter address can lock user funds due to price fluctuations in yieldToken- to-debtToken conversion

AlchemistV3 setTransmuter validates old transmuter solvency at current yieldToken/debtToken rate; later price moves leave redemptions unclaimable or yieldTokens permanently locked.

- Payout: Contest reward
- Severity: medium
- Program: Alchemix
- Credited: Araj
- Disclosed: 2025-07-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.2.9
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.9
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** AlchemistV3 setTransmuter / Transmuter claimRedemption
**Root cause:** setTransmuter() checks old transmuter solvency using the live yieldToken-to-debtToken conversion rate, but claimRedemption() later re-evaluates at the new rate; the old transmuter is no longer authorized to call redeem() after the swap.
**Steps:**
1. User deposits and borrows via alchemist.deposit/mint.
2. externalUser calls transmuterLogic.createRedemption(borrowAmount) locking debtTokens.
3. Advance block past timeToTransmute; borrower repays.
4. Admin calls alchemist.setTransmuter(newTransmuter) — passes since current rate covers totalLocked().
5. Price moves: increase yieldToken supply so 1 debtToken now needs more yieldTokens.
6. externalUser calls transmuterLogic.claimRedemption(1) — reverts because old transmuter must call redeem() but lacks onlyTransmuter authorization.
**How found:** Code review of setTransmuter()'s solvency require() using convertYieldTokensToDebt at spot rate, contrasted with claimRedemption()'s reliance on the same mutable rate and the onlyTransmuter modifier on redeem().
**Exploitation:** No attacker profit path; griefing/lock scenario triggered by admin action plus market drift. Users cannot claim redemptions; excess yieldTokens stranded in old transmuter.
**Insight:** When a migration/swap function validates solvency using a live oracle rate, check whether downstream claims re-read that same rate and whether the old component retains authorization — rate drift between validation and use is the bug.