Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Security and Business Logic Audit of claimAndSwap and _swapUnderlyingToAsset Functions in Arbitrum Network Context

bbash

Summary

The claimAndSwap and _swapUnderlyingToAsset functions are key components of the strategy’s operations, handling token claims from the transmuter and swaps between WETH and alETH through the RamsesRouter. These functions involve interactions with external contracts and rely on price-sensitive operations that are time-dependent.
The deadline for swaps uses block.timestamp without a buffer, which can lead to reverts or vulnerabilities on both congested networks and under specific Arbitrum batching/sequencing scenarios.

Vulnerability Details

Here are the functions: https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/StrategyArb.sol#L71-L88

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IRamsesRouter.route[] calldata _path) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
_swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}
​
​
function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IRamsesRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IRamsesRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}
​

Here is swapExactTokensForTokens: https://github.com/Cyfrin/2024-12-alchemix/blob/main/src/interfaces/IRamses.sol

function swapExactTokensForTokens(
uint256 amountIn,
uint256 amountOutMin,
route[] calldata routes,
address to,
uint256 deadline
) external;

Impact

Transactions may fail or revert due to network latency or Arbitrum’s batching delays.
Impacts real-time usability, especially during network congestion. Front-running or sandwich attacks are possible if swaps involve highly volatile tokens or low-liquidity paths. Arbitrum’s centralized sequencer could inadvertently amplify this risk until decentralization occurs.

Tools Used

Manual Review

Recommendations

Include a buffer (e.g., 15–30 seconds) to account for Arbitrum’s sequencing delays and reduce failures due to tight deadlines.

uint256 BUFFER_TIME = 30;
IRamsesRouter(router).swapExactTokensForTokens(
_amount,
minOut,
_path,
address(this),
block.timestamp + BUFFER_TIME // Adjusted deadline for Arbitrum
);
Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.