Alchemix Transmuter

Summary

The StrategyMainnet contract does not include a setRouter function, making the router address immutable after deployment. But it prevents adaptation to changing conditions, such as:

• The need to replace a compromised router.

• Upgrading to a more efficient or feature-complete router.

Vulnerability Details

In the StrategyMainnet contract, the router is set during initialization in the _initStrategy() function.

There is no mechanism to update the router address after deployment.

If the router becomes deprecated, upgraded, or compromised, the strategy cannot be updated to use a new router. This could lead to:

• Inoperability if the current router is no longer functional.

• Potential losses if the router is compromised and exploited.

Impact

The strategy cannot adapt to changing conditions, such as router upgrades or security incidents.

If the router is compromised in the future, the unlimited token approval could allow it to drain all tokens from the strategy.

Tools Used

manual

Recommendations

Introduce a setRouter function to allow authorized management to update the router address.