The strategy's availableWithdrawLimit()
function fails to validate the operational state of the Alchemix transmuter before including unexchanged balances in the withdrawable amount calculation.
Current implementation: https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L211
If the transmuter is paused:
Strategy reports unexchanged balances as withdrawable.
Withdrawal transactions will revert due to inability to access transmuter.
In a nutshell, the strategy blindly assumes the transmuter is operational and includes unexchanged balances without validating the transmuter's state.
When looking at Yearn's docs for strategy we see this check is implement for both: deposit/withdraw limits: https://docs.yearn.fi/developers/v3/strategy_writing_guide#availabledepositlimitaddress-_owner
If that's the case, the contract should only asset.balanceOf(address(this));
.
Incorrect funds for preview functions
DoS when withdrawing
Manual Review
Only return the contract's balance when the transmuter is paused.(Must be done in all the Strategies contracts)
Also consider adding the availableDepositLimit
implementing the same logic.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.