Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Redundant Slippage Check in claimAndSwap Function

bshyuunn

01. Relevant GitHub Links

02. Summary

The claimAndSwap function includes a redundant require statement to validate minimum output (_minOut) after a swap. Since the router contract already enforces a minimum output check, re-validating _minOut after the swap does not provide additional security and results in unnecessary gas consumption.

03. Vulnerability Details

In the claimAndSwap function, the output of the swap is first validated by the router contract against _minOut. After the swap completes, the following check is performed again:

require((balAfter - balBefore) >= _minOut, "Slippage too high");

Since the router call will revert if _minOut is not met, this second check is never expected to fail. Hence, it is redundant and consumes additional gas without improving security.

04. Impact

The main impact of this redundant check is gas inefficiency. Removing it can reduce transaction costs slightly, improving overall protocol efficiency.

05. Proof of Concept

06. Tools Used

Manual Code Review and Foundry

07. Recommended Mitigation

Remove the redundant post-swap slippage check. Instead, rely solely on the router’s _minOut validation. This will streamline the logic and save on unnecessary gas usage.

function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
uint256 _routeNumber
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
require(_minOut > _amountClaim, "minOut too low");
router.exchange(
routes[_routeNumber],
swapParams[_routeNumber],
_amountClaim,
_minOut,
pools[_routeNumber],
address(this)
);
uint256 balAfter = asset.balanceOf(address(this));
-- require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}
Updates

Appeal created

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.