Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Frontrunning and DOS Vulnerability in _swapUnderlyingToAsset Function

mizila_firox

Summary

Any person or MEV bot can frontrun the contract trades and cause a denial of service or at least a non profit tx when the strategy contracts try to get the premium from the DEXes.

Vulnerability Details

The `_swapUnderlyingToAsset` function swaps WETH to ALETH for profit but anyone can simply frontrun and provoke a DOS every single time the contract tries to profit from the DEX, hence blocking the contract's purpose.

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyArb.sol#L81-L88

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IRamsesRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IRamsesRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}

This claimAndSwap function will check if the trade generated any profits with the require((balAfter - balBefore) >= minOut, "Slippage too high");_ but since anyone can frontrun this tx (including MEV bots) it will always revert assuming the param_ _minOut is not 0. A single person can always make sure the strategies are never profitable.

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IRamsesRouter.route[] calldata _path) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
_swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

Impact

Denial of Service and Frontruning. All 3 contracts in scope have the exact same issue:
https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyArb.sol

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyMainnet.sol

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyOp.sol

Tools Used

Manual

Recommendations

This is an intrinsic blockchain problem and prone to these attacks, I think something like Chainlink Functions might work since it would obfuscate the protocols' strategies to some degree.

Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.