Alchemix Transmuter

Summary

The _harvestAndReport function within the StrategyArb, StrategyMainnet and StrategyOp contracts fails to invoke the _executeHealthCheck function. This omission allows the strategy to report profits or losses without verifying whether these figures fall within predefined acceptable bounds. Consequently, the strategy is vulnerable to inaccurate asset accounting, which can lead to financial discrepancies and potential exploitation.

Vulnerability Details

The _harvestAndReport function is designed to harvest rewards, redeploy idle funds, and accurately account for the total assets held by the strategy. However, it does not call the _executeHealthCheck function, which is crucial for validating the integrity of the reported asset values.

Example of the function implementation:

Impact

Without this health check, there is no mechanism to verify that the new total assets are within safe bounds relative to the previous total assets. This can result in unbounded profit reporting or excessive loss reporting, undermining the integrity of the strategy's financial metrics. Conversely, significant losses might not be accurately reported, misleading stakeholders about the strategy's true performance and potentially causing financial instability.

Tools Used

Manual review

Recommendations

Integrate a call to _executeHealthCheck within the _harvestAndReport function in the scope contracts after calculating _totalAssets. This ensures that all reported profits and losses are within acceptable limits, maintaining accurate asset accounting and protecting the strategy from financial manipulation. Additionally, enable and properly implement reward claiming and asset swapping functionalities to ensure comprehensive asset management and accurate performance reporting.