Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Unrestricted Route Addition in `addRoute` in `StrategyMainnet.sol`

0xvd

Summary

The addRoute function allows the management role to add routes without validation.

This opens the door to potential misconfigured or malicious routes being added, which could lead to failed swaps or asset loss during swap operations.

Vulnerability Details

The addRoute function is responsible for adding swap routes that dictate the path and parameters for token swaps.

However, there is no validation to ensure that the added routes align with the strategy’s expected swap paths, such as starting with the underlying token and ending with the asset token.

function addRoute(
address[11] calldata _route,
uint256[5][5] calldata _swapParams,
address[5] calldata _pools
) external onlyManagement {
routes[nRoutes] = _route;
swapParams[nRoutes] = _swapParams;
pools[nRoutes] = _pools;
nRoutes++;
}

Impact

The _route array is added directly without validation, allowing malicious or unintended routes to be configured.

If an invalid route is added, subsequent swaps using that route could fail or result in unintended token transfers.

Recommendations

Add validation checks to ensure the added route aligns with the expected swap paths, specifically:

Ensure the route starts with the underlying token.

Ensure the route ends with the asset token.

function addRoute(
address[11] calldata _route,
uint256[5][5] calldata _swapParams,
address[5] calldata _pools
) external onlyManagement {
+ // Validate that the route starts with the underlying token and ends with the asset token
+ require(_route[0] == address(underlying), "Route must start with underlying token");
+ require(_route[_route.length - 1] == address(asset), "Route must end with asset token");
​
routes[nRoutes] = _route;
swapParams[nRoutes] = _swapParams;
pools[nRoutes] = _pools;
nRoutes++;
}
Updates

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.