Alchemix Transmuter

Summary

When admin wants to add a new router to the contract it gives an approval for a token. In that case any previous approvals should be deleted.

Vulnerability Details

In StrategyArb and StrategyOp contracts an admin can add a new router at any time by calling setRouter:

In the same time that contract gives an ultimate approval for underlying token for a new router.

There may only be one router in the contract, as it rewrites the state variable when it is updated. So any time a new router is set up, the token approvals for the previous router should be deleted.

Impact

Unexpected consequences for the router that is not used with unlimited token appovals.

Tools Used

Manual review.

Recommendations

Clear approvals for the previous router when adding a new one.