Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Keepers can swap at a loss in strategy contracts

greese

Summary

Documentation states that keepers cannot swap for a loss when converting claimed WETH into alETH however the proper checks are not enforced. The only checks in place are related to slippage to ensure the minimum amount of tokens are received

Vulnerability Details

Lets take the claimAndSwap function in the mainnet strategy as an example. The keeper claims the underlying WETH then swaps it to alETH through the chosen route. It checks that the minimum amount of alETH is received and then deposits it into the transmuter contract. However there are no checks that the swap was done at a premium.

/**
* @dev Function called by keeper to claim WETH from transmuter & swap to alETH at premium
* we ensure that we are always swapping at a premium (i.e. keeper cannot swap at a loss)
* @param _amountClaim The amount of WETH to claim from the transmuter
* @param _minOut The minimum amount of alETH to receive after swap
* @param _routeNumber Calls mapping to the params to be passed into curve router
*/
​
function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
uint256 _routeNumber
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
require(_minOut > _amountClaim, "minOut too low");
​
router.exchange(
routes[_routeNumber],
swapParams[_routeNumber],
_amountClaim,
_minOut,
pools[_routeNumber],
address(this)
);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

Take the following example:

  1. Strategy claims 1 WETH

  2. Current ETH price is $2000

  3. alETH is trading at 0.99 ETH ($1980)

  4. Keeper sets minOut to 1.01 alETH

The transaction would pass the check (1.01 > 1.0) but we're actually trading at a loss because we're getting 1980 worth of alETH for 2000 worth of ETH

Impact

Keeper can swap at a loss

Tools Used

Manual Review

Recommendations

Implement price oracle checks to ensure that alETH is trading at the intended price target

Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.