Summary

The _harvestAndReport function in the StrategyMainnet, StrategyOp, StrategyArb contract does not fulfill its intended purpose as outlined in the Yearn Strategy Writing Guide. According to the guide, this function should:

"Harvest and sell any rewards, reinvest any proceeds, perform any position maintenance and return a full accounting of a trusted amount denominated in the underlying asset the strategy holds."

However, the current implementation of _harvestAndReport:

1. Does not harvest: It does not claim underlying tokens (WETH) from the Transmuter.

2. Does not reinvest: It does not perform any swaps or deposits to reinvest idle funds.

3. Only returns total balance: It merely calculates and returns the sum of unexchanged, asset.balanceOf, and underlyingBalance.

Vulnerability Details

Affected Function:

_harvestAndReport

Root Cause:

The implementation does not include the core harvesting logic, such as:

• Claiming rewards or yield (WETH) from the Transmuter.

• Swapping or reinvesting proceeds into the yield-generating positions (e.g., depositing alETH into the Transmuter).

• Performing position maintenance to optimize strategy performance.

Impact:

The function does not meet its intended purpose, resulting in:

1. Idle Funds: WETH or other idle assets in the contract remain unutilized, reducing yield generation.

2. Incomplete Reporting: The total balance returned is accurate only in terms of raw token holdings, but it does not represent optimized capital allocation.

3. Inefficient Strategy: The strategy does not fully utilize its mechanisms to generate yield, impacting overall performance.

Tools Used

Recommendations

1. Implement Harvesting Logic:
   Add logic to claim rewards or underlying tokens (WETH) from the Transmuter.

2. Include Reinvestment Mechanism:
   After claiming WETH, swap it to alETH (if necessary) and deposit it into the Transmuter to reinvest proceeds.

3. Perform Position Maintenance:
   Implement logic to rebalance or optimize the current positions held by the strategy as part of the harvesting process.