Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing Slippage Protection in `_freeFunds` function in `StrategyOp`

0xvd

Summary

The _freeFunds function in StrategyOp.sol does not include slippage protection when withdrawing assets from the transmuter.

Without validation of the actual amounts received, the function is vulnerable to manipulation or operational inefficiencies during periods of high volatility or low liquidity.

Vulnerability Details

The _freeFunds function withdraws _amount of asset from the transmuter without verifying whether the actual amount received matches the requested amount.

This lack of slippage protection exposes the function to risks of:

Receiving less than the requested amount during volatile market conditions.

Overestimating the strategy's ability to fulfill withdrawal requests.

function _freeFunds(uint256 _amount) internal override {
uint256 totalAvailabe = transmuter.getUnexchangedBalance(address(this));
if (_amount > totalAvailabe) {
transmuter.withdraw(totalAvailabe, address(this));
} else {
transmuter.withdraw(_amount, address(this));
}
}

Impact

Users may receive less than the expected withdrawal amount, leading to financial losses or dissatisfaction.

Recommendations

Introduce a slippage protection mechanism to ensure that the actual amount received is sufficient to meet the requested withdrawal amount.

Validate the received amount against the expected _amount and revert if it falls below an acceptable threshold.

function _freeFunds(uint256 _amount) internal override {
uint256 totalAvailable = transmuter.getUnexchangedBalance(address(this));
+ uint256 amountToWithdraw = (_amount > totalAvailable) ? totalAvailable : _amount;
+
+ // Track balance before withdrawal
+ uint256 balanceBefore = asset.balanceOf(address(this));
+ transmuter.withdraw(amountToWithdraw, address(this));
+
+ // Validate slippage
+ uint256 balanceAfter = asset.balanceOf(address(this));
+ require(balanceAfter - balanceBefore >= amountToWithdraw, "Slippage too high");
}

This ensures that the function only completes the withdrawal if the actual amount received is equal to or greater than the requested amount, protecting users and maintaining protocol integrity

Updates

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.