Alchemix Transmuter

Summary

The onlyKeepers modifier is incorrectly allows both the keeper and the manager to execute functions intended solely for the keeper, such as claimAndSwap.
This deviates from the documented access control guidelines, which state that keepers and managers should have distinct permissions.
This flaw enables the manager to perform unauthorized actions, such as claiming assets and swapping them.

Vulnerability Details

in Conetst Details section in Alchemix contest it says:

1. Keeper: Has permission to call claimAndSwap (i.e. complete a claim from the transmuter for underlying asset & swap back to alx token at premium)

2. Manager: Can call functions with onlyManagement modifier - in this strategy this allows for swap routes to be added (i.e. when swapping via Velo which route is used)

So both keeper and Manager should have different access control.

Access Control Flaw:
The onlyKeepers modifier uses the requireKeeperOrManagement function, which checks if the msg.sender is either the keeper or the manager.
as a result Manager can access functions like claimAndSwap.

Impact

Unauthorized Access: The manager can execute keeper-specific functions, such as claimAndSwap, which involve sensitive fund operations.

Tools Used

Recommendations

add additional check to be sure that only keeper address can make call to claimAndSwap.