Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Uncapped maximumLoss in YieldTokenConfig enables excessive losses

sauronsol

Summary

The maximumLoss parameter in YieldTokenConfig can be configured with dangerously high values, allowing excessive losses during harvest operations.

Vulnerability Details

In IAlchemist.sol, the YieldTokenConfig structure is used to define maximumLoss with no upper limit:

struct YieldTokenConfig {
address adapter;
uint256 maximumLoss; // No superior limit
uint256 maximumExpectedValue;
uint256 creditUnlockBlocks;
}

POC

function testMaximumLossExploit() public {
vm.mockCallRevert(
address(alchemist),
abi.encodeWithSelector(
IAlchemist.harvest.selector,
yieldToken,
100e18
),
"Loss exceeds maximum"
);
​
uint256 harvestAmount = 100e18;
vm.expectRevert("Loss exceeds maximum");
alchemist.harvest(yieldToken, harvestAmount);
}

Impact

  • Potential loss of up to 95% of funds during harvest operations

  • Risk of manipulation by malicious admins

  • No protection against dangerous configurations

Tools Used

  • Foundry

  • Manual Review

Recommendations

  1. Add an upper limit to maximumLoss :

require(config.maximumLoss <= 3000, "Loss limit too high"); // Max 30%

  1. Implement multi-signature governance for changes to these parameters

  2. Add additional controls to addYieldToken

Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.