Alchemix Transmuter

Summary

_harvestAndReport function is used to harvest all rewards, redeploy any idle funds and return an accurate accounting of all funds currently held by the Strategy. However, currently the claimable funds are not added to the total assets and also they are not claimed.

Vulnerability Details
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L172-L192
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L148-L171

In _harvestAndReport (in the StrategyArb and StrategyMainnet contracts) the claimable funds are not added to the total assets and also they are not claimed.

Impact

Wrong total assets calculation and no claiming of claimable funds.

Tools Used

Manual Review

Recommendations

Make a call to claim the claimable funds if they are more than 0 and add them to the sum of the total assets.