57476 sc high forcerepay fails to decrement global cumulativeearmarked

Submitted on Oct 26th 2025 at 14:45:14 UTC by @Paludo0x for Audit Comp | Alchemix V3

• Report ID: #57476

• Report Type: Smart Contract

• Report severity: High

• Target: https://github.com/alchemix-finance/v3-poc/blob/immunefi_audit/src/AlchemistV3.sol

• Impacts:

  • Protocol insolvency

Description

Brief/Intro

During liquidations, AlchemistV3::_forceRepay() correctly reduces the account earmarked value account.earmarked but does not reduce the global earmarked cumulativeEarmarked.

Vulnerability Details

The buggy snippet is the following:

    function _forceRepay(uint256 accountId, uint256 amount) internal returns (uint256) {
      ....
        // Repay debt from earmarked amount of debt first
        uint256 earmarkToRemove = credit > account.earmarked ? account.earmarked : credit;
        account.earmarked -= earmarkToRemove;

        creditToYield = creditToYield > account.collateralBalance ? account.collateralBalance : creditToYield;
        account.collateralBalance -= creditToYield;

        uint256 protocolFeeTotal = creditToYield * protocolFee / BPS;

        emit ForceRepay(accountId, amount, creditToYield, protocolFeeTotal);

        if (account.collateralBalance > protocolFeeTotal) {
            account.collateralBalance -= protocolFeeTotal;
            // Transfer the protocol fee to the protocol fee receiver
            TokenUtils.safeTransfer(myt, protocolFeeReceiver, protocolFeeTotal);
        }

        if (creditToYield > 0) {
            // Transfer the repaid tokens from the account to the transmuter.
            TokenUtils.safeTransfer(myt, address(transmuter), creditToYield);
        }
        return creditToYield;
    }

While in repay() call global earmarked is reduced:

function repay(uint256 amount, uint256 recipientTokenId) public returns (uint256) {
....

      uint256 earmarkToRemove = credit > account.earmarked ? account.earmarked : credit;
        account.earmarked -= earmarkToRemove;

        uint256 earmarkPaidGlobal = cumulativeEarmarked > earmarkToRemove ? earmarkToRemove : cumulativeEarmarked;
        cumulativeEarmarked -= earmarkPaidGlobal;

....

This breaks the core invariant that the global earmark tracks the aggregate of user earmarks.

Because cumulativeEarmarked is used both as the denominator for redemption weighting and to compute liveUnearmarked = totalDebt - cumulativeEarmarked for future earmarks, the error propagates into worngly priced redemptions and persistent accounting drift.

These are the relevant snippet where cumulativeEarmarked is used:

    function _earmark() internal {

...
        uint256 liveUnearmarked = totalDebt - cumulativeEarmarked;
        if (amount > liveUnearmarked) amount = liveUnearmarked;

        if (amount > 0 && liveUnearmarked != 0) {
            // Previous earmark survival
            uint256 previousSurvival = PositionDecay.SurvivalFromWeight(_earmarkWeight);
            if (previousSurvival == 0) previousSurvival = ONE_Q128;

            // Fraction of unearmarked debt being earmarked now in UQ128.128
            uint256 earmarkedFraction = _divQ128(amount, liveUnearmarked);

            _survivalAccumulator += _mulQ128(previousSurvival, earmarkedFraction);
            _earmarkWeight += PositionDecay.WeightIncrement(amount, liveUnearmarked);

            cumulativeEarmarked += amount;
        }
...
 }

  function _calculateUnrealizedDebt(uint256 tokenId)
        internal
        view
        returns (uint256, uint256, uint256)
    {

....
       if (block.number > lastEarmarkBlock) {
....
            uint256 liveUnearmarked = totalDebt - cumulativeEarmarked;
            if (amount > liveUnearmarked) amount = liveUnearmarked;

            if (amount > 0 && liveUnearmarked != 0) {
                // Previous earmark survival
                uint256 previousSurvival = PositionDecay.SurvivalFromWeight(earmarkWeightCopy);
                if (previousSurvival == 0) previousSurvival = ONE_Q128;

                // Fraction of unearmarked debt being earmarked now in UQ128.128
                uint256 earmarkedFraction = _divQ128(amount, liveUnearmarked);

                survivalAccumulatorCopy += _mulQ128(previousSurvival, earmarkedFraction);
                earmarkWeightCopy += PositionDecay.WeightIncrement(amount, liveUnearmarked);
            }
        }
...
    }

Impact Details

These are the main impacts:

• Users debts are reduced less than they should during redemptions

• Protocol global accounting corruption: divergence between burned synthetics and aggregate debt reduction

• Protocol risk over time: repeated liquidations via _forceRepay() can degrade solvency

Given the above impacts the severity is CRITICAL.

Proof of Concept

Proof of Concept

The PoC forces calling of _forceRepay() during a liquidation and demonstrates that global cumulativeEarmarked doesn't decrease after a liquidation.

This is the log:

[PASS] test_Bug_ForceRepay_DoesNotDecrementCumulativeEarmarked() (gas: 1729373)
Logs:
  === before _forceRepay ===
  account earmarked 600000000000000000000
  cumulativeEarmarked 600000000000000000000
  === after _forceRepay ===
  account earmarked 0
  cumulativeEarmarked 600000000000000000000

Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 55.10ms (34.43ms CPU time)

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity 0.8.28;

import {IERC20} from "../../lib/openzeppelin-contracts/contracts/token/ERC20/IERC20.sol";
import {Test} from "forge-std/Test.sol";
import {StdStorage, stdStorage} from "forge-std/StdStorage.sol";
import {console} from "forge-std/console.sol";
import "./AlchemistV3.t.sol";
import {AlchemistNFTHelper} from "./libraries/AlchemistNFTHelper.sol";
import {AlchemistV3} from "../AlchemistV3.sol";


contract Bug_ForceRepay_CumulativeEarmark_PoC is AlchemistV3Test {
    using stdStorage for StdStorage;

    uint256 private constant ACCOUNTS_SLOT = 31;

    function setAccountCollateral(address alchemistAddr, uint256 accountId, uint256 amount) internal {
        bytes32 accountSlot = keccak256(abi.encode(accountId, ACCOUNTS_SLOT));
        vm.store(alchemistAddr, accountSlot, bytes32(amount));
    }

    function setAccountDebt(address alchemistAddr, uint256 accountId, uint256 amount) internal {
        bytes32 accountSlot = keccak256(abi.encode(accountId, ACCOUNTS_SLOT));
        bytes32 debtSlot = bytes32(uint256(accountSlot) + 1);
        vm.store(alchemistAddr, debtSlot, bytes32(amount));
    }

    function setAccountEarmarked(address alchemistAddr, uint256 accountId, uint256 amount) internal {
        bytes32 accountSlot = keccak256(abi.encode(accountId, ACCOUNTS_SLOT));
        bytes32 earmarkedSlot = bytes32(uint256(accountSlot) + 2);
        vm.store(alchemistAddr, earmarkedSlot, bytes32(amount));
    }

    function test_Bug_ForceRepay_DoesNotDecrementCumulativeEarmarked() public {
        address user = address(0xbeef);
        address liquidator = address(0xcafe);
        uint256 collateralAmount = 10_000e18;
        uint256 debtAmount = 600e18;
        uint256 totalDebtGlobal = debtAmount * 2;
        uint256 earmarkedAmount = debtAmount;

        deal(address(vault), user, collateralAmount);

        vm.startPrank(user);
        IERC20(address(vault)).approve(address(alchemist), collateralAmount);
        alchemist.deposit(collateralAmount, user, 0);
        vm.stopPrank();

        uint256 tokenId = AlchemistNFTHelper.getFirstTokenId(user, address(alchemistNFT));

        // Force the account into a state with earmarked debt and corresponding global totals.
        setAccountCollateral(address(alchemist), tokenId, collateralAmount);
        setAccountDebt(address(alchemist), tokenId, debtAmount);
        setAccountEarmarked(address(alchemist), tokenId, earmarkedAmount);

        stdstore.target(address(alchemist)).sig("totalDebt()").checked_write(totalDebtGlobal);
        stdstore.target(address(alchemist)).sig("cumulativeEarmarked()").checked_write(earmarkedAmount);
        stdstore.target(address(alchemist)).sig("collateralizationLowerBound()").checked_write(type(uint256).max);
        stdstore.target(address(alchemist)).sig("lastEarmarkBlock()").checked_write(block.number);

        uint256 cumulativeBefore = alchemist.cumulativeEarmarked();
        (,, uint256 earmarkedBefore) = alchemist.getCDP(tokenId);
        assertEq(earmarkedBefore, earmarkedAmount, "setup failed");
        console.log("=== before _forceRepay ===");
        console.log("account earmarked", earmarkedBefore);
        console.log("cumulativeEarmarked", cumulativeBefore);

        // Force the branch in _liquidate that executes `_forceRepay()`; since earmarked == debt,
        // the subsequent `account.debt == 0` early return prevents `_doLiquidation()` from running.
        vm.prank(liquidator);
        (uint256 yieldAmount,,) = alchemist.liquidate(tokenId);
        assertGt(yieldAmount, 0, "liquidation path must execute _forceRepay()");

        (,, uint256 earmarkedAfter) = alchemist.getCDP(tokenId);
        uint256 cumulativeAfter = alchemist.cumulativeEarmarked();
        console.log("=== after _forceRepay ===");
        console.log("account earmarked", earmarkedAfter);
        console.log("cumulativeEarmarked", cumulativeAfter);

        assertEq(earmarkedAfter, 0, "_forceRepay() burned the user earmark");
        assertEq(cumulativeAfter, cumulativeBefore, "BUG: global cumulativeEarmarked stays inflated");
    }
}