Alchemix Transmuter

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L48

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L42

The `setRouter` function in both `StrategyArb` and `StrategyOp` contracts sets a new router address and grants it approval for the maximum underlying token amount. However, it does not reset the approval for the old router, potentially leaving it with unlimited spending rights, which can lead complete loss of funds if the old router address is compromised.

​

When the `setRouter` function is called, the approval for the old router is not revoked. This means the old router retains unlimited access to the underlying tokens.

​

function setRouter(address _router) external onlyManagement {

}

​

The `safeApprove` function directly updates the allowance for the new router without resetting the approval for the old router.

​

Complete loss of funds in case of compromised old router.

Manual review

Before approving the new router, reset the approval for the old router to zero.