Alchemix Transmuter

Summary

The setProfitMaxUnlockTime function in TokenizedStrategy.sol allows manipulation of share prices through front-running, enabling users to profit from predictable changes in share value during report calls. This attack would be very easy to execute since the change to profitMaxUnlockTime is applied once report is called. Meaning that once setProfitMaxUnlockTime is called, the attcker just needs to wait for report to be called and then deposit or withdraw to profit from the predictable share price change.

Vulnerability Details

The vulnerability exists in the profit unlocking mechanism of the TokenizedStrategy contract. Here's how it works:

1. The setProfitMaxUnlockTime function changes the time period over which profits are unlocked

2. This directly affects the profitUnlockingRate calculation in the report function

3. The unlocking rate impacts the total supply of shares, which is used to calculate:

   • Share price for deposits

   • Share price for withdrawals

The issue arises because changes to profitMaxUnlockTime create predictable step-wise changes in share prices. This can be exploited by:

1. Monitoring for setProfitMaxUnlockTime transactions

2. Front-running the subsequent report call by:

   • Depositing if share price will increase

   • Withdrawing if share price will decrease

3. Profiting from the predictable price movement

Impact

• Users can extract value from the protocol by front-running share price changes

• Other users suffer losses as front-runners capture the profits

• The predictability of price changes undermines fair value distribution

Tools Used

Manual Review

Recommendations

Add a timelock mechanism for deposits and withdrawals after to prevent front running and race conditions related to the report function. This prevents exploitation of step-wise price changes by ensuring users cannot front-run the price impact of profitMaxUnlockTime changes.

Alternatively remove the setProfitMaxUnlockTime function to remove any risk of this exploit. If this path is chosen, ensure that the profitMaxUnlockTime is carefully considered so that no change is needed.