Alchemix Transmuter

Summary

in the _swapUnderlyingToAsset we are not verifying the minout is equal to the amount or not.

Vulnerability Details

https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyArb.sol#L81

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IRamsesRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
@>>require(minOut > _amount, "minOut too low");
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IRamsesRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}

Impact

we cannot swap when minOut is equal to _amount.

Tools Used

Recommendations

equire(minOut >= _amount, "minOut too low");