Alchemix Transmuter

Summary

The value returned by the balanceDeployed() function and _harvestAndReport() of strategy(StrategyOp，StrategyMainnet，StrategyArb) is inaccurate.

Vulnerability Details

The value returned by the balanceDeployed() directly sums the amounts of wETH and alETH where There is a proportional conversion relationship between alETH and WETH。As follows，transmuter.getUnexchangedBalance(address(this)) returns amount of AlETH，underlying.balanceOf(address(this)) returns amount of WETH，asset.balanceOf(address(this)) returns amount of AlETH。

function balanceDeployed() public view returns (uint256) {

return transmuter.getUnexchangedBalance(address(this)) + underlying.balanceOf(address(this)) + asset.balanceOf(address(this));

}

_harvestAndReport() function has the same problem

Impact

misleading customers.

Tools Used

just code review

Recommendations

There are two solutions, I prefer the second one.

1. Using router to convert the amount of ETH to the amount of ALETH（IRamsesRouter in StrategyArb, IVeloRouter in StrategyOp, ICurveRouterNG in StrategyMainnet）

2. balanceDeployed() and _harvestAndReport() return the two amounts(WETH and ALETH) ​​separately.