Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Event Emission After State Changes in `StrategyOp::claimAndSwap` and most functions.

myssteeque

Description

The StrategyOp::claimAndSwap function allows authorized keepers to claim rewards, swap tokens, and deposit the resulting balance into the transmuter contract. However, this function does not emit any event to log critical state changes, such as the claimed amount, swapped amount, or deposited amount.

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IVeloRouter.route[] calldata _path ) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
​
_swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

Without event emissions, it becomes difficult for external observers, such as dApps, monitoring tools, or end-users, to track key activities and verify the function's execution.

Impact

Without events, it's difficult to track the flow of funds and state changes externally.

Tool Used

Manual review

Recommended mitigation

Emit appropriate events after key state changes within the claimAndSwap function to improve transparency and accountability. For example:

Proposed Event
Define an event to capture the key details of the function's execution:

event ClaimAndSwapExecuted(
address indexed keeper,
uint256 amountClaimed,
uint256 amountSwapped,
uint256 amountDeposited
);

Updated function

function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
IVeloRouter.route[] calldata _path
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
​
_swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
​
require((balAfter - balBefore) >= _minOut, "Slippage too high");
​
uint256 amountDeposited = asset.balanceOf(address(this));
transmuter.deposit(amountDeposited, address(this));
// Emit event
emit ClaimAndSwapExecuted(msg.sender, _amountClaim, (balAfter - balBefore), amountDeposited);
}
​
Updates

Appeal created

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.