Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Asset Mismanagement Vulnerability in claimAndSwap Function May Lead to Unintended Fund Deposits

deeney

Summary

The claimAndSwap function in the contract exhibits an issue related to asset mismanagement. Specifically, the function deposits the entire balance of asset (alETH) held by the contract into the transmuter after performing a swap. This includes not only the swapped amount but also any existing asset balance unrelated to the current operation. This mismanagement could lead to unintended fund deposits, disruption of protocol operations, and potential exploitation in scenarios where the contract holds significant unrelated funds.

Vulnerability Details

The issue arises in this function;

function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
uint256 _routeNumber
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
require(_minOut > _amountClaim, "minOut too low");
​
router.exchange(
routes[_routeNumber],
swapParams[_routeNumber],
_amountClaim,
_minOut,
pools[_routeNumber],
address(this)
);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
@> transmuter.deposit(asset.balanceOf(address(this)),address(this));
}

Here, the function deposits the entire balance of asset held by the contract into the transmuter, rather than just the amount received from the router.exchange call. This approach fails to account for any pre-existing asset balance in the contract, leading to unintended consequences.

Impact

It doesn't directly allow for fund theft, but it could result in significant fund mismanagement or protocol disruption.

Tools Used

Manual Review

Recommendations

It is recommended to deposit only swapped funds into the transmuter.

Updates

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.