Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Claimable balance not included in total assets calculation leads to value underestimation for oracle APY

alix402

Summary

The _harvestAndReport() function does not include the claimable WETH balance from the transmuter when calculating total assets. While claimable is retrieved via getClaimableBalance(), it is not added to the final _totalAssets sum. This results in an underestimation of the strategy's total value, particularly affecting the oracle APY calculations.

The impact is relatively low since the funds are not at risk, but it means the reported strategy value and performance metrics will be lower than the actual real value.

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L162-L173

function _harvestAndReport()
internal
override
returns (uint256 _totalAssets)
{
@>> uint256 claimable = transmuter.getClaimableBalance(address(this));
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
// NOTE : possible some dormant WETH that isn't swapped yet
uint256 underlyingBalance = underlying.balanceOf(address(this));
// in case that there are some alEth deposited in the strategy they weren not be displayed here
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
}

Recommendation:

Add the claimable balance to the total assets calculation:

function _harvestAndReport()
internal
override
returns (uint256 _totalAssets)
{
uint256 claimable = transmuter.getClaimableBalance(address(this));
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
// NOTE : possible some dormant WETH that isn't swapped yet
uint256 underlyingBalance = underlying.balanceOf(address(this));
// in case that there are some alEth deposited in the strategy they weren not be displayed here
- _totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
+ _totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance + claimable;
Updates

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect accounting in `_harvestAndReport` claimable should be included

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.