Alchemix Transmuter

Summary

The _swapUnderlyingToAsset() function contains an incorrect slippage check:

require(minOut > _amount, "minOut too low");

This logic assumes that minOut must be greater than the input _amount, which is flawed. The proper check should ensure that the received tokens (balAfter - balBefore) meet or exceed the minOut parameter. As currently implemented, this bug can lead to swaps at unfavorable rates, resulting in financial losses for the protocol.

Vulnerability Details

An attacker or malicious keeper could intentionally set minOut to an unrealistic value, passing the current flawed validation. This could result in the protocol swapping tokens at a loss, depleting funds.

An attacker (such as a malicious keeper or rogue user with the ability to call claimAndSwap()) could set the minOut value to an overly low threshold, while still being able to carry out a swap with a high slippage. The protocol would not detect this because of the flawed validation logic.

• Impact: This allows the attacker to manipulate the swap rate, potentially draining funds or causing losses without triggering any slippage protections. The attacker could exploit this repeatedly, draining the liquidity pool or creating an opportunity for significant arbitrage.

Tools Used

Recommendations

The current check only verifies that minOut > _amount, which is insufficient for validating slippage. It doesn't ensure that the actual swap amount received is above the minOut threshold.

• Solution: The validation should ensure that the received amount after the swap is greater than or equal to the minOut value. This can be done by comparing the actual output of the swap with the minOut parameter before finalizing the transaction.

This ensures that the swap output is properly checked against the slippage tolerance (minOut).

Include SafeMath Checks

• Problem: There is a risk that improper validation of swap results could lead to financial losses or exploitation.

• Solution: Use SafeMath to prevent any overflow/underflow during calculations and ensure that slippage conditions are safe and reliable.