Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Shutdown Status Check in `_harvestAndReport` Function

brene

Summary

The _harvestAndReport function includes a comment suggesting that strategists should manually check the shutdown status using TokenizedStrategy.isShutdown(). However, this check is not implemented within the function itself, which can lead to inconsistent behavior if not properly managed.

Vulnerability Details

The function is designed to be called even post-shutdown, with the expectation that strategists will manage redeployment decisions based on the shutdown status. However, the absence of an internal check means this responsibility is left to external callers.

/**
* @dev Internal function to harvest all rewards, redeploy any idle
* funds and return an accurate accounting of all funds currently
* held by the Strategy.
*
* This should do any needed harvesting, rewards selling, accrual,
* redepositing etc. to get the most accurate view of current assets.
*
* NOTE: All applicable assets including loose assets should be
* accounted for in this function.
*
* Care should be taken when relying on oracles or swap values rather
* than actual amounts as all Strategy profit/loss accounting will
* be done based on this returned value.
> * This can still be called post a shutdown, a strategist can check
> * `TokenizedStrategy.isShutdown()` to decide if funds should be
> * redeployed or simply realize any profits/losses.
*
* @return _totalAssets A trusted and accurate account for the total
* amount of 'asset' the strategy currently holds including idle funds.
*/
function _harvestAndReport()
internal
override
returns (uint256 _totalAssets)
{
​
uint256 claimable = transmuter.getClaimableBalance(address(this));
​
if (claimable > 0) {
// transmuter.claim(claimable, address(this));
}
​
// NOTE : we can do this in harvest or can do seperately in tend
// if (underlying.balanceOf(address(this)) > 0) {
// _swapUnderlyingToAsset(underlying.balanceOf(address(this)));
// }
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
​
// NOTE : possible some dormant WETH that isn't swapped yet
uint256 underlyingBalance = underlying.balanceOf(address(this));
​
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
}

Impact

Without an internal check, the function may inadvertently redeploy funds during a shutdown, leading to operational inconsistencies and profits and losses could be inaccurately reported if the function continues normal operations during a shutdown.

Tools Used

Manual Review

Recommendations

Integrate a check for the strategy's shutdown status directly within the _harvestAndReport function. This ensures consistent behavior regardless of external calls.

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.