Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Swapping amount check.

unu5464

Summary

The claimAndSwap function currently uses balanceOf to calculate the received amount after a swap. This approach can lead to inaccurate calculations if there are external factors affecting the contract’s token balance, such as dust, manual transfers, or additional swaps. Instead, the function should rely on the actual amount returned by the exchange function to ensure accurate accounting.

Vulnerability Details

Lack of Reliance on Actual Swap Output:

  • The router.exchange function likely provides a return value indicating the exact amount swapped. Ignoring this and relying on balanceOf is less reliable and unnecessarily risky.

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, uint256 _routeNumber) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
// asset is alETH and underlying is WETH
uint256 balBefore = asset.balanceOf(address(this));
require(_minOut > _amountClaim, "minOut too low");
​
router.exchange(
routes[_routeNumber],
swapParams[_routeNumber],
_amountClaim,
_minOut,
pools[_routeNumber],
address(this)
);
​
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

Impact

The reliance on balanceOf can lead to inaccuracies in calculating the true output of the swap, which might cascade into errors in profit/loss reporting.

Recommendations

Use Actual Swap Output:

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, uint256 _routeNumber) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
// asset is alETH and underlying is WETH
- uint256 balBefore = asset.balanceOf(address(this));
require(_minOut > _amountClaim, "minOut too low");
​
+ uint256[] amounts = router.exchange(
routes[_routeNumber],
swapParams[_routeNumber],
_amountClaim,
_minOut,
pools[_routeNumber],
address(this)
);
​
+ require(amounts[amounts.length - 1] >= _minOut):
​
- uint256 balAfter = asset.balanceOf(address(this));
- require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}
Updates

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.