Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Manipulation of creditUnlockBlocks enables rapid credit farming

sauronsol

Summary

The creditUnlockBlocks parameter in YieldTokenConfig can be set to extremely low values, potentially allowing rapid credit farming through quick deposit/withdrawal cycles.

Vulnerability Details

In IAlchemist.sol, creditUnlockBlocks lacks minimum value validation:

struct YieldTokenConfig {
// ...
uint256 creditUnlockBlocks; // No minimum value enforced
}

Impact

  • Possible credit farming through rapid cycles

  • System economics could be manipulated

  • Unfair advantage for sophisticated users

  • Potential drain of protocol rewards

Tools Used

  • Foundry

  • Manual Review

Recommendations

  • Enforce minimum unlock period:

require(config.creditUnlockBlocks >= MIN_UNLOCK_BLOCKS, "Unlock period too short");

  • Add cooldown between operations:

mapping(address => uint256) lastOperationBlock;
require(block.number >= lastOperationBlock[msg.sender] + MIN_COOLDOWN, "Cooldown active");
Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.