Alchemix Transmuter

Summary

The StrategyOp smart contract contains a critical vulnerability within its claimAndSwap function. Specifically, when a keeper invokes claimAndSwap with a minimal amount of WETH (e.g., 1 WETH), the function erroneously attempts to deposit the entire alETH balance (asset.balanceOf(address(this))) back into the transmuter instead of just the newly swapped alETH from the claimed WETH.

Vulnerability Details

The claimAndSwap function only has to swap the amount of WETH specified by _amountClaim.

But the contract swaps all amount.

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L88

Impact

Incomplete swapping limits the strategy's ability to reinvest assets effectively, potentially leading to lower yields and compromised financial performance.

Tools Used

Recommendations

Adjust the claimAndSwap function to deposit only the alETH obtained from the recent swap, excluding any residual alETH.