Alchemix Transmuter

Summary

When creating a strategy in the constructor of StrategyMainnet a router address is set when a call to _initStrategy is made. However, the router then cannot be changed by the management role because this strategy is missing the setRouter function. This can cause serious issues if the router is found to be vulnerable or problematic.

Vulnerability Details
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L27-L47

There is no way to change the router on the StrategyMainnet.

Impact

This can cause serious issues if the router is found to be vulnerable or problematic.

Tools Used

Manual Review

Recommendations

Add a way for the management role to change the router as it is in the other two strategies (StrategyArb, StrategyOp).