Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing return value check for `swapExactTokensForTokens` on `strategyOp::_swapUnderlyingToAsset` function.

myssteeque

Description

The strategyOp::_swapUnderlyingToAsset function lacks a return value check after calling swapExactTokensForTokens.This omission prevents the function from tracking the exact outcome of the transaction and ensuring that the minimum expected amount was received.

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
//This first check is on the input parameters before the swap but there is no check on the actual outcome of the swap after it executes.
require(minOut > _amount, "minOut too low");
​
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
@>> IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}
​

Impact

  • The swap could fail silently (return 0) without being detected.

  • Even if the swap succeeds, it might return less than minOut due to slippage, which wouldn't be caught.

Tools Used

Manual review

Recommended Mitigation

To fully mitigate this issue, you should check the return value after the swap, like this:

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
require(minOut > _amount, "minOut too low");
​
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
uint256 amountReceived = IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
+ require(amountReceived >= minOut, "Swap resulted in insufficient output");
}
​

This modification ensures that the actual result of the swap meets the minimum output requirement.

Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.