# Liquity ActivePool: urgentRedemption bonus drains sUSDe collateral

After Liquity branch shutdown, public urgentRedemption let anyone redeem BOLD against selected undercollateralized troves for a bonus, draining sUSDe from ActivePool.

- Payout: Real-world hack
- Severity: medium
- Program: ActivePoolUrgentRedemption
- Credited: DeFiHackLabs
- Disclosed: 2025-07-02
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/ActivePoolUrgentRedemption_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250702-activepoolurgentredemption
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** TroveManager.urgentRedemption / ActivePool on Ethereum
**Root cause:** Once the branch was shut down, urgentRedemption was callable by anyone and allowed the caller to pick which undercollateralized troves to redeem against, paying a collateral bonus that exceeded the BOLD cost.
**Steps:**
1. Flash-borrow 108,500 USDT from Morpho
2. add_liquidity into Curve USDT/BOLD pool to mint LP, then exchange LP in Curve BOLD pool for BOLD
3. Approve BOLD to TroveManager and call `urgentRedemption(boldAmount, [4 chosen troveIds], 0)` to redeem against selected undercollateralized troves
4. Receive sUSDe collateral from ActivePool, swap sUSDe to USDT via Fluid DEX `swapIn(true,...)`
5. Swap USDT surplus to WETH via Uniswap V3 exactInputSingle, withdraw WETH to ETH
6. Repay Morpho flash loan and transfer ~1.038 ETH profit to attacker
**How found:** Attacker recognized that post-shutdown urgentRedemption was permissionless and let the caller choose troveIds, enabling cherry-picking of troves whose collateral bonus made redemption profitable.
**Exploitation:** Atomic flash-loan-funded cycle: borrow USDT, route through Curve to obtain BOLD, redeem BOLD via urgentRedemption against hand-picked underwater troves to extract sUSDe at a bonus, sell sUSDe for USDT, convert surplus to ETH, repay loan.
**Insight:** When a protocol's shutdown/emergency redemption path becomes permissionless, check whether the caller can select which positions to redeem against — cherry-picking underwater troves with a bonus turns a safety mechanism into an arbitrage.