Alchemix Transmuter

Summary

The contract uses infinite approvals (type(uint256).max) for the underlying token when interacting with external protocols like the router and the transmuter.

While convenient, this approach increases the risk of token theft if an approved contract is compromised.

Vulnerability Details

In several parts of the contract, infinite token approvals are granted using the safeApprove method.

For example:

Impact

A compromised or malicious router/transmuter can drain the full token balance of the contract.

Recommendations

Approve only the specific amount required for each operation rather than granting unlimited approvals