Alchemix Transmuter

Summary:

The StrategyOp::claimAndSwap function calls external contracts (transmuter.claim and _swapUnderlyingToAsset) before updating the contract's state. This could potentially allow reentrancy attacks if the external contracts call back into the contract.

Vulnerability Details:

• Severity: HIGH

• Explanation: The claimAndSwap function calls external contracts, that are:

  1. transmuter.claim,

  2. _swapUnderlyingToAsset

  These external calls are being made before updating the contract's state which might potentially allow reentrancy attacks if the external contracts call back into the contract.

Impact:

Reentrancy attacks could lead to unauthorized manipulation of the contract's state and potential loss of funds.

Tools Used:

Manual Testing

Recommendations:

1. Use the Checks-Effects-Interactions (CEI) pattern by updating the contract's state before making external calls.

2. Alternatively, use the ReentrancyGuard modifier from OpenZeppelin.