Alchemix Transmuter

Summary

The setRouter function allows management to set a new router and grants the new router an infinite approval to spend the underlying token. However, the function does not revoke the approval of the previous router.

Vulnerability Details

The setRouter() function in the StrategyOp, StrategyArb, and StrategyMainnet contracts allows management to set a new router and grants the new router an infinite approval to spend the underlying token. However, the function does not revoke the approval of the previous router, leaving the previous router with lingering approval to spend the contract's tokens.

Impact

If the previously approved router remains authorized to spend tokens, it poses a security risk:

1. Unauthorized Usage: If the previous router is compromised or malicious, it could continue to spend the underlying token without restriction.

2. Loss of Funds: If the previous router’s contract is exploited, it could drain all approved tokens from the protocol.

Tools Used

manual review

Recommendations

Revoke the approval of the previous router before setting a new one. This can be done by calling safeApprove() with a value of 0 for the previous router.