Alchemix Transmuter

Description:

The StrategyOp::_harvestAndReport, StrategyArb::_harvestAndReport and StrategyMainnet::_harvestAndReport are, according to the docs, supposed to harvest rewards and provide accounting, the function though, only fetches balances (accounting), it misses any logic responsible for harvesting and redeploying idle funds.

Vulnerable Code:

StrategyOp::_harvestAndReport, StrategyArb::_harvestAndReport and StrategyMainnet::_harvestAndReport:

As you can see at the highlighted spots, any function calls responsible for harvesting or redeploying tokens are simply missing, only balance queries are performed.

Impact:

As stated by the docs the _harvestAndReport function is called to harvest all rewards, redeploy any idle funds and return an accurate accounting of all funds currently held by the Strategy. Since the function is not actually harvesting or redeploying idle funds the strategy loses the ability to maximize user investments.

Likelihood: High
Impact: Low, since no direct funds are at risk, neither does it impair base functionality of the contract

Severity: Medium

Tools Used:

Manual review.

Recommended Mitigation:

Implement logic with matches the docs, or should the docs be deprecated adjust the docs and function name.