Alchemix Transmuter

Summary

The StrategyArb.sol and StrategyOp.sol contracts have a security vulnerability where they fail to revoke token approvals from old routers when updating to a new one. This leads to accumulation of token approvals, potentially exposing the strategy's underlying tokens to risk if any previous router becomes compromised.

Vulnerability Details

When updating the router via setRouter, the contracts approve the new router but don't revoke permissions from the old one:

In StrategyArb.sol:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L42-L45

Similarly in StrategyOp.sol:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L48-L51

This creates multiple security concerns:

• Every router change leaves another contract with unlimited approval

• Historical approvals remain active indefinitely

• No mechanism exists to revoke old approvals

• Strategy's underlying tokens remain exposed to old routers

Impact

The main risks are:

1. Compromised previous routers could still access strategy funds

2. Each router upgrade increases attack surface

3. No way to revoke historical approvals without contract upgrade

4. Full underlying token balance at risk if old router is exploited

Tools Used

Manual Review

Recommendations

Remove approve for old router