Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Deposit of Contract Balance in claimAndSwap function could lead to Unintentional Deposit of Pre-existing Balances

oluwaseyisekoni

Summary

The claimAndSwap function in the smart contracts deposits the entire asset balance of the contract (address(this)) into the transmuter after performing a swap. This can unintentionally include pre-existing balances of the asset token leading to unintended side effects

Vulnerability Details

The issue arises in the following line of the claimAndSwap function:

@> transmuter.deposit(asset.balanceOf(address(this)), address(this));

Here, the entire balance of the asset token held by the contract is deposited, which may unintentionally include tokens that were not obtained from the swap operation.

The _freeFundfunction in the strategy contracts (StrategyMainnet.sol, StrategyOp.sol, StrategyArb.sol) show that the contracts can hold assets token which are for withdrawals. Depositing the entire balance of the asset token held by the contract could lead tio unitentional deposits of these tokens

Impact

Unintentional Use of Pre-existing Balances

Severity

  • Impact: Medium

  • Likelihood: Medium

  • Risk Level: Medium

Tools Used

Manual review

Recommendations

function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
uint256 _routeNumber
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
require(_minOut > _amountClaim, "minOut too low");
​
router.exchange(
routes[_routeNumber],
swapParams[_routeNumber],
_amountClaim,
_minOut,
pools[_routeNumber],
address(this)
);
​
// Validate swap output
uint256 balAfter = asset.balanceOf(address(this));
+ uint256 swappedAmount = balAfter - balBefore;
+ require(swappedAmount >= _minOut, "Slippage too high");
- transmuter.deposit(asset.balanceOf(address(this)), address(this));
// Deposit only the swapped amount
+ transmuter.deposit(swappedAmount, address(this));
}
​
Updates

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.