Alchemix Transmuter

Summary

A design limitation exists in both StrategyArb.sol and StrategyOp.sol where the router address can be updated via setRouter, but the claimAndSwap functions use hardcoded DEX-specific interfaces. This mismatch means that while the router address can be changed, the contracts can't actually interact with new routers that have different interfaces.

Vulnerability Details

The setRouter function allows changing the DEX router:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L42

However, the swap functions use DEX-specific interfaces: StrategyArb.sol:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L87

StrategyOp.sol:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L102

The core issue is that:

• The DEX interfaces are hardcoded (Ramses/Velodrome)

• Different DEXs use different route parameter structures

• No way to update the interface when the router changes

Impact

If management needs to change the router:

• claimAndSwap will revert due to interface mismatch

• Strategy won't be able to swap claimed tokens

• New strategy contracts would need deployment instead of simple router updates

• Core functionality breaks despite valid router address update

Tools Used

Manual Review

Recommendations

Implement a low-level call approach to make the router interaction interface-agnostic: