Alchemix Transmuter

Summary

The addRoute function in the StrategyMainnet contract lacks validation for route parameters and swap configurations, which could lead to failed swaps. The function should implement comprehensive validation checks for routes, swap parameters, and pool addresses to ensure swaps execute successfully.

Vulnerability Details

In the StrategyMainnet.sol contract, the addRoute function is used to configure swap routes for converting between underlying tokens and synthetic tokens. However, the current implementation lacks crucial validation checks:

1. The route configuration process:

1. These routes are later used in critical swap operations:

This can lead to:

• Failed swaps during claimAndSwap execution

Impact

The vulnerability could result in:

• Failed swaps causing strategy operations to be blocked

• Potential denial of service if invalid routes prevent successful swaps

• Keeper operations being disrupted due to failed route execution

Tools Used

Manual Review

Recommendations

Implement comprehensive validation in the addRoute function ensureing the input and output tokens are valid and that the swap params and pools are valid.