Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Dormant WETH tokens are expected to eventually get swapped but they don't

kalogerone

Vulnerability Details

According to the comments in the _harvestAndReport function, any extra WETH in the contract gets accounted for the total assets, since it's supposed to eventually get swapped and deposited into Alchemix.

StrategyOp.sol
​
function _harvestAndReport() internal override returns (uint256 _totalAssets) {
uint256 claimable = transmuter.getClaimableBalance(address(this));
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
​
@> // NOTE : possible some dormant WETH that isn't swapped yet
uint256 underlyingBalance = underlying.balanceOf(address(this));
​
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
}

However, this is not possible. The only way to swap WETH for alETH is in the claimAndSwap function:

StrategyOp.sol
​
function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IVeloRouter.route[] calldata _path)
external
onlyKeepers
{
@> transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
​
@> _swapUnderlyingToAsset(_amountClaim, _minOut, _path);
​
uint256 balAfter = asset.balanceOf(address(this));
​
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}
​
​
function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");
​
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
@> IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}

As we can see, the Keepers have to pass as input the exact amount of WETH to claim from Alchemix. Later, only this exact amount of WETH gets swapped for alETH and nothing more. This means, that no extra "dormant WETH that isn't swapped yet" can get swapped and deposited back to the trasnmuter.

The same applies for all of the strategy contracts.

Impact

Extra WETH tokens are unable to get swapped to alETH and get deposited into the transmuter.

Tools Used

Manual review

Recommendations

Consider always swapping the whole WETH balance of the strategy contracts.

Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Dormant WETH in the contract will never be swapped back to alETH

kalogerone Submitter
10 months ago
inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Dormant WETH is not properly treated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.