Alchemix Transmuter

Summary

The function that is used for adding a new route to the contract lacks some important checks described in the official documentation.

Vulnerability Details

When admin want to add a route he calls addRoute function:

A new route is passed into Curve Router for swap as can be seen here : https://docs.curve.fi/router/CurveRouterNG/

Here we can see some requirements for the checks:

When calling the function, the array must always include 11 addresses. Unused spots in the array need to be filled with ZERO_ADDRESS. The route consists of tokens and pools or zaps. The first address is always the input token, the last one always the output token.

So there should be a check for an array length and for the first and last token addresses.

Impact

A swap route can be created incorrectly.

Tools Used

Manual review.

Recommendations

Consider providing a check for the array length and first and last token addresses.