Submission Details
Severity:
The issue of mistakenly depositing all alETH into the transmuter contract.
Summary
Storing all the alETH in the contract may not be the intended behavior for the user.
Vulnerability Details
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
There is an issue with depositing assets into transmuter; the contract is currently depositing all alETH, not just the alETH obtained from the swap.
Impact
If these alETH are user funds, rather than the contract's own funds, incorrect deposits could lead to fund loss or mismanagement of funds.
Tools Used
Manual review
Recommendations
Modify the deposit logic to ensure only the alETH obtained from the swap is deposited:
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(balAfter - balBefore, address(this));
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366 OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.