Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of slippage protection in initial deposits

setstacklist

In all three strategy contracts, the _deployFunds function deposits assets directly to the transmuter without any slippage protection:

function _deployFunds(uint256 _amount) internal override {
transmuter.deposit(_amount, address(this));
}

This function is called during initial deposit operations, meaning a malicious actor could manipulate the price of alETH right before a large deposit, causing the deposit to receive fewer shares than expected. This is particularly dangerous as the function is called in a permissionless context after deposits/mints.

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L60

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L80

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L66

Updates

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.