Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Valid

StrategyOp and StrategyArb give underlying token allowances to router but do not remove allowances when router is updated

y0ng0p3

Summary

StrategyOp and StrategyArb give underlying token allowances to router but do not remove allowances when router is updated.

Vulnerability Details

StrategyOp and StrategyArb give underlying token allowances to router.

File: https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L38-L41
​
router = 0xa062aE8A9c5e11aaA026fc2670B0D65cCc8B2858;
underlying.safeApprove(address(router), type(uint256).max);
}
File: https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L34-L39
​
function _initStrategy() internal {
router = 0xAAA87963EFeB6f7E0a2711F397663105Acb1805e;
underlying.safeApprove(address(router), type(uint256).max);
}

router can be changed any time via the setRouter function.

Files:
* https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L42-L45
* https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L48-L51
​
function setRouter(address _router) external onlyManagement {
router = _router;
underlying.safeApprove(router, type(uint256).max);
}

Nowhere in the strategy contracts there is a way to removed approvals from router.
This allows the contract to enter a state where router is updated via setRouter but the approvals given to the old router are not removed.

Impact

The old router will continue to have underlying token approvals for StrategyOp or/and StrategyArb, so it can continue to spend the protocol's tokens when this is not the protocol's intention as the protocol has changed router.

Tools Used

Manual review.

Recommendations

In the setRouter function, remove all allowances for the old router before updating it.

Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Old router approval is not revoked after an update

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.