# ActivePoolScrvUsd: urgentRedemption drains collateral post-shutdown

After branch shutdown, public urgentRedemption let any USDaf holder redeem selected undercollateralized troves for scrvUSD collateral with bonus, netting ~$4.2k via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: ActivePoolScrvUsd
- Credited: DeFiHackLabs
- Disclosed: 2025-07-05
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/ActivePoolScrvUsdUrgentRedemption_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250705-activepoolscrvusdurgentredemption
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** TroveManager.urgentRedemption / ActivePool collateral
**Root cause:** Once the branch was shut down, urgentRedemption remained publicly callable, allowing any USDaf holder to choose profitable undercollateralized troves and redeem their debt for ActivePool scrvUSD collateral with a bonus.
**Steps:**
1. Flash-borrow 225,000 USDT from Morpho via `flashLoan(USDT, 225000e6, data)`.
2. Approve and add USDT liquidity to Curve USDT/USDaf LP: `add_liquidity([0, amount], 0)`.
3. Approve LP and swap LP to USDaf via Curve USDaf pool: `exchange(1, 0, curveLp, 0, address(this))`.
4. Approve USDaf to TroveManager and call `urgentRedemption(usdafAmount, [troveId1, troveId2], 0)` to redeem selected troves for scrvUSD collateral.
5. Swap received scrvUSD to sUSDe via Curve scrvUSD/sUSDe pool: `exchange(0, 1, scrvUsdBalance, 0, address(this))`.
6. Swap sUSDe to USDT via Fluid DEX: `swapIn(true, susdeAmount, 1, address(this))`.
7. Swap surplus USDT to WETH via Uniswap V3 `exactInputSingle` (fee 3000).
8. Withdraw WETH to ETH and transfer profit to attacker.
**How found:** Attacker likely noticed that after branch shutdown, urgentRedemption remained callable and allowed selecting specific trove IDs, enabling profitable redemption of undercollateralized troves for bonus collateral.
**Exploitation:** Attacker flash-borrowed USDT, converted to USDaf, used urgentRedemption to redeem two specific undercollateralized troves for scrvUSD at a bonus, then routed scrvUSD through Curve and Fluid to USDT, swapped surplus to WETH, and kept ~1.67 ETH profit after repaying flash loan.
**Insight:** When a lending protocol shuts down a branch, check whether privileged redemption functions remain public and allow caller-chosen trove IDs; such functions can become arbitrage vectors against the protocol's own collateral.