Alchemix Transmuter

Summary

Routers can retain max approval indefinitely, risking total asset loss if a router is compromised. Add a disapproval function for outdated or malicious routers to mitigate this.

Vulnerability Details

Since routers are from different protocols eventually one of them might have a vulnerability and the strategy contracts don't have a way to disaprove routers from draining all tokens in the case of an emergency.

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyArb.sol#L42-L45

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyOp.sol#L48-L51

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyMainnet.sol#L43-L47

here we don't have a setRouter function but it approves it in the _initStrategy instead, so basicaly the same thing:

Impact

A compromised router could drain all tokens approved by these contracts.

Tools Used

Manual analysis.

Recommendations

Implement a mechanism to revoke token approvals from outdated or malicious routers in all strategy contracts.