Alchemix Transmuter

Summary

In the StrategyMainnet contract, the claimAndSwap function only swaps claimed underlying tokens (WETH) to alETH, rather than the entire WETH balance held by the contract. Additionally, the _harvestAndReport function does not perform any swaps or deposits. As a result, any existing WETH balance in the contract remains unconverted and locked, with no mechanism for the admin to deposit it as alETH into the Transmuter.

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L92-L113

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L172-L192

This issue happens also in StrategyArb, StrategyOp.

Vulnerability Details

1. claimAndSwap:

   • Only swaps the WETH claimed from the Transmuter during the claim step, ignoring any other WETH held in the contract.

2. _harvestAndReport:

   • Does not include any logic to swap the WETH balance or deposit it as alETH into the Transmuter.

Root Cause:

• There is no mechanism in the contract to handle existing WETH (underlying tokens) held by the contract.

• The absence of a process to convert or utilize the WETH balance leads to it being indefinitely locked within the contract.

Impact

1. Locked Capital:

   • Any WETH held in the contract is effectively unusable, leading to inefficiencies and loss of potential yield.

2. Admin Inability to Deposit WETH:

   • Even if the admin wants to convert WETH to alETH and deposit it into the Transmuter, the contract does not provide a mechanism to do so.

3. Reduced Yield Optimization:

   • Without converting WETH to alETH and depositing it, the strategy cannot fully optimize its yield.

Tools Used

Recommendations

1. Add Functionality to Swap and Deposit Idle WETH:

   • Introduce a function to convert the entire WETH balance held by the contract to alETH and deposit it into the Transmuter.

2. Incorporate Swapping in _harvestAndReport:

   • Modify _harvestAndReport to include logic for swapping any idle WETH to alETH and depositing it into the Transmuter.