Alchemix Transmuter

Summary

The claimAndSwap function in the protocol can be front-run by attackers to manipulate prices and force transaction to revert. This allows malicious actors to prevent keepers from executing core strategy operations, potentially maintaining depeg situations and disrupting protocol operations.

Vulnerability Details

Vulnerable code:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L92

An attacker can monitor the mempool for keeper transactions and front-run them:

• Do a swap to move the price

Here is an example attack:

1. An attacker monitors the mempool for a keeper's transaction.

2. When he sports a keeper's transaction he front-run it and manipulates the price

3. Finally the keeper's transaction executes and reverts due to price change

Impact

1. Keepers cannot execute core strategy operations when needed

2. Depeg situations could be maintained artificially

3. Higher costs for keepers due to failed transactions

4. Potential loss of arbitrage opportunities for the strategy

5. Could be exploited by competitors to maintain favorable market conditions

6. Malicious actors could prevent peg restoration to benefit their positions

7. Protocol loses ability to reliably perform operations during high volatility periods

Tools Used

Manual Review

Recommendations

1. Use private mempools or Flashbots for keeper transactions to prevent front-running

2. Add maximum price impact checks to prevent extreme price manipulation

3. Consider implementing keeper rotation or cooldown periods