Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Race condition in mint/repay functions allows debt manipulation

sauronsol

Summary


A race condition between mint and repay functions in the Alchemist contract allows users to manipulate their debt position by repaying less than minted and immediately minting again.

Vulnerability Details

The contract allows users to:

  1. Mint tokens

  2. Repay less than the minted amount

  3. Immediately mint again without proper debt validation

function testMintRepayRaceCondition() public {
uint256 mintAmount = 100e18;
vm.startPrank(user);
// Initial mint
alchemist.mint(mintAmount, user);
// Repay less than minted
uint256 repayAmount = mintAmount - 10e18;
alchemist.repay(underlying, repayAmount, user);
// Can immediately mint again
alchemist.mint(10e18, user); // Exploits debt tracking
}

Impact

  • Users can manipulate their debt position

  • Potential economic damage to the protocol

  • Risk of undercollateralized positions

  • System debt accounting could become inaccurate

Tools Used

  • Foundry

  • Manual Review

Recommendations

  1. Add debt cooldown period:

mapping(address => uint256) lastRepayTimestamp;
​
function repay(address _underlying, uint256 _amount, address _recipient) external {
require(block.timestamp >= lastRepayTimestamp[msg.sender] + 1 hours, "Cooldown active");
// ... existing code ...
lastRepayTimestamp[msg.sender] = block.timestamp;
}

  1. Enforce full repayment:

require(repayAmount >= mintedAmount, "Must repay full amount");
Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.