Alchemix Transmuter

Summary

The claimAndSwap function in the protocol can be front-run by attackers to manipulate prices and force transaction to revert. This allows malicious actors to prevent keepers from executing core strategy operations, potentially maintaining depeg situations and disrupting protocol operations.

Vulnerability Details

Vulnerable code:
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L92

The claimAndSwap function performs several checks to ensure profitable swaps:

1. Checks that amountToClaim < minOut

2. Checks that balAfter - balBefore > minOut

An attacker can monitor the mempool for keeper transactions and front-run them using either:

• A single large swap to significantly move the price

• Multiple smaller swaps to gradually affect the price (aka. block space filling)

Example attack sequence:

1. An attacker monitors the mempool for a keeper's transaction. He can also create a bot to do that.

2. When he sports a keeper's transaction he front-run it and manipulates the price

3. Finally the keeper's transaction executes and reverts due to price change

Impact

1. Keepers cannot execute core strategy operations when needed

2. Depeg situations could be maintained artificially

3. Higher costs for keepers due to failed transactions

4. Potential loss of arbitrage opportunities for the strategy

Tools Used

Manual Review

Recommendations

The thing that can be done to be protected againts this attack is to use private mempools or Flashbots for keeper transactions to prevent front-running.