Alchemix Transmuter

Summary

The addRoute function in the StrategyOp contract allows the Manager to introduce new swap routes without validating the input data. This lack of validation exposes the protocol to significant risks, including unauthorized token swaps, denial of service (DoS), and economic exploits. Malicious or malformed routes can disrupt the strategy's operations, drain funds, or cause yield inefficiencies. Implementing comprehensive input validation and a whitelist mechanism is critical to mitigate these risks.

Technical Details

Code Reference

The addRoute function directly accepts arrays for _route, _swapParams, and _pools without verification:

Workflow Context

1. Functionality:

   • addRoute allows the Manager to configure new routes for token swaps via Curve.

2. Input Parameters:

   • _route: Array of 11 addresses defining the swap path.

   • _swapParams: Multidimensional array defining swap parameters.

   • _pools: Array of 5 pool addresses used in the route.

3. Issue:

   • The function does not verify whether the inputs correspond to valid or safe configurations, leaving the protocol vulnerable to malicious or malformed routes.

Exploitation Scenarios

Scenario 1: Malicious Route Addition

1. Setup:

   A malicious actor compromises the Manager role and adds a route where one of the pool addresses points to a malicious contract.

2. Execution:

   The malicious pool exploits the unlimited approval granted to the router, siphoning WETH or alETH during a swap operation invoked by claimAndSwap.

3. Impact:

   The protocol’s funds are drained to the malicious contract, causing significant financial loss.

Scenario 2: Revert-Induced Denial of Service (DoS)

1. Setup:

   The Manager adds a route with a pool that always reverts transactions.

2. Execution:

   When claimAndSwap is invoked, the swap operation fails due to the revert, preventing yield generation.

3. Impact:

   All depositors are affected as the strategy cannot execute swaps, leading to a complete halt in operations.

Scenario 3: Unfavorable Trade Routes

1. Setup:

   A route is added with parameters that facilitate trades at unfavorable rates, possibly involving a compromised or rogue pool.

2. Execution:

   When swaps are executed, the strategy consistently receives less value in return, reducing yields.

3. Impact:

   Users experience significant financial losses due to persistent inefficiencies in trade execution.

Impact Analysis

Severity: High

1. Financial Impact:

   Unauthorized token swaps or unfavorable trade routes can lead to substantial fund losses.

2. Operational Impact:

   Reverting routes or invalid configurations cause operational disruptions, affecting all depositors.

3. Reputational Impact:

   Users lose trust in the protocol’s security and reliability, deterring adoption.

Root Cause Analysis

1. Lack of Input Validation:

   The function does not verify whether the provided _route, _swapParams, and _pools correspond to safe or valid configurations.

2. Unlimited Privileges for Manager Role:

   The Manager has unchecked authority to add routes, increasing the attack surface if compromised.

Mitigation Recommendations

1. Implement Comprehensive Input Validation

• Pool Address Verification:

  • Ensure all pool addresses in _pools are recognized and trusted within the Curve ecosystem.

  require(isTrustedPool(_pools[i]), "Unrecognized pool address");

  ​

  • Maintain a mapping of approved pools:

    mapping(address => bool) public trustedPools;

    ​

• Route Length and Structure Validation:

  • Check that _route and _swapParams conform to expected formats.

  require(_route.length > 0 && _route.length <= 11, "Invalid route length");

  require(_swapParams.length == _route.length - 1, "Invalid swap parameters");

  ​

2. Introduce a Whitelist Mechanism

• Maintain a whitelist of approved pools and routers:

  mapping(address => bool) public approvedPools;

  function addPoolToWhitelist(address pool) external onlyGovernance {

  approvedPools[pool] = true;

  }

  ​

• Reject any additions that do not conform to the whitelist:

  require(approvedPools[_pools[i]], "Pool not approved");

  ​

Proof of Concept (PoC)

Reproducing the Issue

1. Deploy the contract and assign Manager privileges.

2. Add a route with a malicious pool address:

   strategy.addRoute(

   [maliciousPool, ...],

   [validSwapParams],

   [maliciousRouter, ...]

   );

   ​

3. Invoke claimAndSwap with the malicious route, draining funds.

Verifying Mitigation

1. Implement pool address validation and whitelist checks.

2. Attempt to add a route with an unapproved pool or malformed parameters.

3. Observe that the transaction is reverted with a validation error.