Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Inaccurate accounting in _harvestAndReport function

setstacklist

The _harvestAndReport function incorrectly accounts for assets by double counting underlying balances. The function returns:

_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;

However, unexchanged already includes both the unexchanged alETH and unclaimed WETH balances. By adding underlyingBalance separately, the function overcounts the available assets. This would cause the strategy to report inflated asset values, leading to incorrect share prices and potential loss of funds for users.

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L170
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L191
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L173

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.