Alchemix Transmuter

Summary

in StrategyMainnet, StrategyArb, and StrategyOp- The routerand the transmutercontracts are given approvals for underlying, and assettokens, respectively.

The approvals are made by using the safeApprovefunction from OpenZeppelin's SafeERC20.sol

However, safeApprovehas been deprecated and replaced with safeIncreaseAllowance/ safeDecreaseallowance

Vulnerability Details

The contracts use a deprecated function from the openzeppelin SafeERC20.solcontract.

Impact

safeApprovehas been deprecated and replaced with safeIncreaseAllowance/ safeDecreaseallowan. The function as is, may currently work, but if a bug is found in this version of openzeppelin and this protocol is forced to upgrade to a new version of the OpenZeppelin contract - that new version may not have the safeApprovefunction.

Tools Used

Manual Review

Recommendations

Becasue the contracts only use safeApproveto set the initial allowance to type(uint256).max and makes no further approvals, safeIncreaseAllowancecan be and should be used instead.