Alchemix Transmuter

Summary

In StrategyArb, StrategyOp and StrategyMainnet it is stated that NOTE : since the asset is ALETH, we need to set the underlying to WETH. However, that is never checked and the underlying token of the transmuter is used. This can lead to wrong calculations in the case in which the underlying token is actually not WETH.

Vulnerability Details
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L15

The underlying token should be WETH as noted in a comment but this is never ensured. What is more, it cannot be changed in the case of a problem and the whole contract will have to be fully redeployed.

Impact

This can lead to calculation errors and a wrong token being used for the strategies.

Tools Used

Manual Review

Recommendations

Ensure that the underlying token is WETH before setting it in the constructor of the given strategies.