Alchemix Transmuter

Summary

The StrategyOp contract grants unlimited token approvals to external contracts, potentially increasing the risk of token theft if these external contracts are compromised.

Vulnerability Details

The StrategyOp contract uses type(uint256).max to approve unlimited token spending for both the transmuter and router contracts. This practice, while convenient, exposes the contract to unnecessary risk.

Affected code:
https://github.com/Cyfrin/2024-12-alchemix/blob/5c19ee37df3aa7605bf782c9c40a482fd82adc67/src/StrategyOp.sol#L27
https://github.com/Cyfrin/2024-12-alchemix/blob/5c19ee37df3aa7605bf782c9c40a482fd82adc67/src/StrategyOp.sol#L39

These approvals are set in the constructor and _initStrategy function respectively, meaning they persist for the entire lifetime of the contract.

Impact

If the transmuter or router contracts are compromised, an attacker could potentially drain all of the approved tokens from the StrategyOp contract. While this doesn't represent an immediate vulnerability, it significantly increases the potential impact of a security breach in the approved contracts.

Tools Used

manual code review.

Recommendations

1. Implement a more granular approval system:

   • Approve only the exact amount needed for each transaction.

   • Reset the approval to zero after each transaction.

2. Replace the current unlimited approvals with transaction-specific approvals. For example:

Bellow is a finding explaining the same issue

Description

Several parts of code grant unlimited type(uint).max approvals even when it's not justifiable:

• https://github.com/bebop-dex/bebop-smart-contracts/blob/f42cc5efe7a843bb015aec409aaa08e7643d0ca9/src/contracts/BebopSettlement.sol#L155

• https://github.com/bebop-dex/bebop-smart-contracts/blob/f42cc5efe7a843bb015aec409aaa08e7643d0ca9/src/contracts/base/BebopTransfer.sol#L103

No threat is inherent to it. However, it diminishes the overall contract security and could potentially be exploited by various attack vectors.

Recommendation

It's recommended to grant approvals only for the exact amount that is anticipated to be spent.