Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Frontrunning and DOS Vulnerability in _swapUnderlyingToAsset Function

mizila_firox

Summary

Any person or MEV bot can frontrun the contract trades and cause a denial of service or at least a non profit tx when the strategy contracts try to get the premium from the DEXes.

Vulnerability Details

The `_swapUnderlyingToAsset` function swaps WETH to ALETH for profit but anyone can simply frontrun and provoke a DOS every single time the contract tries to profit from the DEX, hence blocking the contract's purpose.

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyArb.sol#L81-L88

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IRamsesRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IRamsesRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}

This claimAndSwap function will check if the trade generated any profits with the require((balAfter - balBefore) >= minOut, "Slippage too high");_ but since anyone can frontrun this tx (including MEV bots) it will always revert assuming the param_ _minOut is not 0. A single person can always make sure the strategies are never profitable.

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IRamsesRouter.route[] calldata _path) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
_swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

Impact

Denial of Service and Frontruning. All 3 contracts in scope have the exact same issue:
https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyArb.sol

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyMainnet.sol

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyOp.sol

Tools Used

Manual

Recommendations

This is an intrinsic blockchain problem and prone to these attacks, I think something like Chainlink Functions might work since it would obfuscate the protocols' strategies to some degree.

Updates

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.