Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Exchange rate can be manipulated by keeper

mladenov

Summary

The StrategyArb contract is vulnerable to rate manipulation by keepers who can bypass strategy's rate check mechanism by directly calling Ramses Router with the strategy's WETH after claiming it from Transmuter.

Vulnerability Details

StrategyArb.sol

This check ensures that the keeper cannot execute swap at lose which means the exchange rate must greather than 1:1.

Malicious keeper can bypass this check by directly interacting with Ramses router and invoke swapExactTokensForTokens function with bad parameters.

require(minOut > _amount, "minOut too low");
function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IRamsesRouter.route[] calldata _path) internal {
require(minOut > _amount, "minOut too low"); // Protection that can be bypassed
IRamsesRouter(router).swapExactTokensForTokens(
_amount,
minOut,
_path,
address(this),
block.timestamp
);
}

Ramses Router

You can find the implementation contract of Ramses router here:
https://arbiscan.io/address/0x0e216dd4f1b5ea81006d41b79f9a1a69a38f3e37#code

function swapExactTokensForTokens(
uint256 amountIn,
uint256 amountOutMin, // Can be set very low
route[] calldata routes,
address to,
uint256 deadline
) external returns (uint256[] memory amounts) {
_safeTransferFrom(
routes[0].from, // Strategy's WETH
msg.sender, // Keeper
pairFor(routes[0].from, routes[0].to, routes[0].stable),
amountIn
);
}

Impact

Users will lose some of their funds since there will be a slippage if the malicous keeper execute the function with less amountOutMin

Tools Used

Manual Review

Recommendations

Approve keepers to spend tokens for limited time. Let keepers spend tokens only when they call the claimAndSwap function from strategy contract, when the tx is successful set approved tokens back to 0.

In this way if keeper calls the swapExactTokensForTokens function directly from Ramses router the tx will fail, because he won't be approved to spend tokens.

Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.