Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

In `StrategyMainnet::_initStrategy` the protocol use wrong router address for initialization

mrmorningstar

Summary

The _initStrategy in StrategyMainnet uses this address for initialization:

/**
* @dev Initializes the strategy with the router address & approves WETH to be swapped via router
*/
function _initStrategy() internal {
router = ICurveRouterNG(0xF0d4c12A5768D806021F80a262B4d39d26C58b8D);
underlying.safeApprove(address(router), type(uint256).max);
}

Vulnerability Details

But if we check on Curve docs the correct address is this:

0x16C6521Dff6baB339122a0FE25a9116693265353

We can see that (first address in the table) on this link:

https://docs.curve.fi/references/deployed-contracts/#curve-router

Impact

Protocol will use wrong router address for initializing strategy.

Tools Used

Manual Review

Recommendations

Make sure protocol use the correct and updated router address.

Make following changes in _initStrategy:

/**
* @dev Initializes the strategy with the router address & approves WETH to be swapped via router
*/
function _initStrategy() internal {
- router = ICurveRouterNG(0xF0d4c12A5768D806021F80a262B4d39d26C58b8D);
+ router = ICurveRouterNG(0x16C6521Dff6baB339122a0FE25a9116693265353);
underlying.safeApprove(address(router), type(uint256).max);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
6 months ago

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.