Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of Access Control Mechanisms

mishraji874

Description: The interfaces IAlchemist lack robust access control mechanisms, particularly for critical functions like deposit, claim, withdraw, and administrative actions.

In IAlchemist:

  • addYieldToken() and setYieldTokenEnabled() only have a basic admin() check

  • No multi-signature or timelocked admin functions

  • Potential for single point of compromise

Impact:

  • Unauthorized users could potentially add malicious yield tokens

  • Complete control over protocol's token configurations

  • Risk of economic manipulation

Proof of Concept:

contract ExploitContract {
IAlchemist public alchemist;
function exploit() external {
// Assuming admin is compromised or predictable
alchemist.addYieldToken(maliciousToken, maliciousConfig);
alchemist.setYieldTokenEnabled(maliciousToken, true);
}
}

Recommended Mitigation:

  • Implement multi-signature admin controls

  • Add role-based access control (RBAC)

  • Use OpenZeppelin's Ownable or AccessControl contracts

  • Implement time-locks for critical administrative functions

Updates

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.