Alchemix Transmuter

Summary:

The exchange function in the ICurveRouterNG interface does not specify or enforce the handling of a return value (uint256), which represent critical information of the received amount of the final output token by the swap.

Vulnerability Details

The CurveRouterNG documentation says

Router.exchange(_route: address[11], _swap_params: uint256[5][5], _amount: uint256, _expected: uint256, _pools: address[5] = empty(address[5]), _receiver: address = msg.sender) -> uint256

Function to perform a token exchange with up to 5 swaps in a single transaction.

Returns: received amount of the final output token (uint256).

Function to perform a token exchange with up to 5 swaps in a single transaction.

Returns: received amount of the final output token (uint256).

Ignoring the return value increases the risk of vulnerabilities due to faulty or malicious router behavior in claimAndSwap::StrategyMainnet.sol

Impact

Unverified Swap Success: Since router.exchange does not return or validate the actual amount received from the swap, there’s no guarantee that the swap executed as intended.

Tools Used

Manual review

Recommendations:

1. Validate Return Value of exchange: router.exchange function is updated to return the actual amount received, use it for validation

2. Balance Check as a Backup: Retain the balance validation (balAfter - balBefore) >= _minOut as a secondary check to ensure consistency.