Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Asset Valuation Due to Direct Addition of WETH and alETH Balances

pro_king

Summary

The strategy incorrectly calculates total assets by directly adding WETH and alETH balances without proper conversion, leading to inaccurate share price calculations and potential accounting issues.

Vulnerability Details

The vulnerability exists in multiple functions where WETH and alETH balances are added directly:

  1. In balanceDeployed():

function balanceDeployed() public view returns (uint256) {
@>>> return transmuter.getUnexchangedBalance(address(this)) +
underlying.balanceOf(address(this)) + // WETH balance
asset.balanceOf(address(this)); // alETH balance
}

  1. In _harvestAndReport():

function _harvestAndReport() internal override returns (uint256 _totalAssets) {
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
uint256 underlyingBalance = underlying.balanceOf(address(this));
@>>> _totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
}

The issue arises because:

  1. WETH and alETH have different market values

  2. alETH typically trades at a discount to WETH

  3. Direct addition assumes 1:1 value which is incorrect

Impact

  1. Incorrect Total Assets Reporting

    • Strategy reports inflated/deflated total assets

    • Share price calculations become inaccurate

  2. Example Scenario:

Strategy State:
- 10 WETH in underlying balance
- 15 alETH in asset balance
- 20 alETH in unexchanged balance
- Market: 1 WETH = 1.05 alETH
​
Current Calculation:
Total = 10 + 15 + 20 = 45 units
​
Correct Calculation:
WETH in alETH = 10 * 1.05 = 10.5
Total = 10.5 + 15 + 20 = 45.5 units

Tools Used

  • Manual Review

Recommendations

  1. Implement Price Conversion of WETH to alETH:

  2. Add Price Oracle Integration:

Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

balanceDeployed() and _harvestAndReport() add WETH and alETH, but they have different prices

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.