Alchemix Transmuter

Summary

The StrategyMainnet::claimAndSwap function does not check if there is sufficient underlying token balance before attempting the swap, which may lead to failures or unexpected behaviors when the balance is insufficient.

Vulnerability Details

The function assumes that the contract always has enough underlying token balance when calling the Curve router's exchange function. However, it does not explicitly verify whether the contract has enough underlying tokens before performing the swap. This missing balance check could lead to the following issues:

1. Transaction Failures: If the contract does not have sufficient underlying tokens, the transaction will fail, wasting gas.

2. State Inconsistency: If external actions (e.g., third-party withdrawals) cause the contract’s underlying token balance to become insufficient, it could cause an inconsistent state.

Impact

The missing balance check could lead to the following consequences:

1. Transaction Failure: This will result in wasted gas as transactions may fail.

2. State Inconsistency: The contract’s state may become inconsistent, affecting the normal execution of the strategy.

3. Potential Exploitation: An attacker could potentially manipulate the contract's balance to cause unexpected behaviors or exploit the situation.

Tools Used

Manual Code Audit

Recommendations

Before calling the router.exchange function in StrategyMainnet::claimAndSwap, the contract should verify that there is enough underlying token balance. For example:

This ensures that the contract has enough tokens before proceeding with the exchange.