Alchemix Transmuter

Summary

The _harvestAndReport function in the StrategyMainnet contract incorrectly sums the balance of the underlying token (WETH) with the strategy's asset (alETH) without considering their exchange rate. This results in inaccurate profit and loss calculations when reporting to the vault.

Vulnerability Details

The report function in the TokenizedStrategy contract is responsible for reporting profits and losses to the vault. It calls the harvestAndReport function, which in turn calls StrategyMainnet:_harvestAndReport. This function is expected to return the total assets in terms of alETH. However, it currently includes the balance of the underlying token (WETH) in its calculation, leading to incorrect asset reporting.

Code Analysis

In the _harvestAndReport function, the total assets are calculated as follows:

The issue lies in the inclusion of underlyingBalance (WETH) in the _totalAssets calculation without converting it to alETH. Since WETH and alETH do not have a 1:1 exchange rate, this results in incorrect asset reporting.

Example Scenario

• The current market exchange rate is 1 alETH = 0.95 WETH.

• The transmuter holds 100 unexchanged alETH, and the strategy contract holds 10 WETH.

• _harvestAndReport incorrectly reports 110 alETH as total assets.

• The correct calculation should convert 10 WETH to alETH, resulting in approximately 10.526 alETH.

• Therefore, the total assets should be reported as 110.526 alETH.

Impact

The incorrect asset reporting can lead to underreported profits, resulting in users receiving less alETH than they are entitled to. This can cause financial losses for users and affect the overall trust in the strategy's accuracy.

Tools Used

Manual review and cursor AI

Recommendations

To resolve this issue, the _harvestAndReport function should convert the underlying token balance (WETH) to the strategy's asset (alETH) using the current exchange rate before summing it with other assets. This will ensure accurate profit and loss calculations and prevent potential user losses.

You can see the example in AcrossStrategy :
https://yearn.fi/v3/1/0x9861708f2ad2BD1ed8D4D12436C0d8EB1ED36f1c
https://etherscan.io/address/0x9861708f2ad2BD1ed8D4D12436C0d8EB1ED36f1c#code#L2201