Alchemix Transmuter

Summary

The YieldTokenMock.price() function uses a strict equality check (==) to determine if totalSupply() is zero. This can be manipulated by an attacker who could send a tiny amount of tokens to ensure totalSupply() is never exactly zero, causing unexpected behavior in price calculations.

Vulnerability Details

I think following problems may occur:

• The price calculation could become permanently stuck in an unintended state

• Token pricing mechanism could be manipulated to always return the non-zero price path

• This could affect any protocol mechanisms that rely on accurate price calculations

• Could lead to economic exploits if price is used for minting, burning, or exchange calculations

Impact

Medium

Tools Used

Slither

Recommendations

We can use a threshold check instead of strict equality to determine if the total supply is effectively zero: