Summary

The _harvestAndReport function in the StrategyMainnet contract sums the balances of unexchanged, asset.balanceOf(address(this)), and underlyingBalance to calculate the total assets. However, it does not account for the price difference between alETH (synthetic Ether) and WETH (underlying Ether). While both represent Ether, their prices can diverge due to market conditions, leading to inaccurate asset accounting.

This calculation assumes a 1:1 parity between alETH and WETH, which is not always valid. Without considering price differences, the reported total assets can deviate significantly from the true value.

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L173

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L191

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L170

Vulnerability Details

The function assumes that the prices of alETH and WETH are always the same, but in practice, synthetic assets can diverge from their underlying counterparts due to:

1. Market Dynamics: alETH might trade at a premium or discount to WETH.

2. Conversion Delays: The Transmuter may not convert synthetic tokens into their underlying equivalents instantly, leading to temporary price discrepancies.

3. Liquidity Variations: Market liquidity for alETH and WETH can differ, further exacerbating price divergence.

As a result, summing the token balances without converting them using an accurate price feed results in incorrect accounting.

Impact

1. Inaccurate Reporting: The _harvestAndReport function may report incorrect total asset values, affecting strategy performance metrics.

2. Mismanagement Risk: Strategies relying on this function for decision-making could mismanage funds due to inaccurate data.

Tools Used

Recommendations

1. Incorporate Oracle Prices:
   Use a reliable on-chain oracle to fetch the current exchange rate between alETH and WETH.

2. Use a Unified Accounting Framework:
   Normalize all balances (unexchanged, asset.balanceOf, and underlyingBalance) to the same unit (e.g., WETH) before summing.