Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Potential for Front-Running in `StrategyOp::claimAndSwap`, swap path or amount is predictable might lead to swap rate manipulation.

affanimran1303

Summary:

The StrategyOp::claimAndSwap function allows keepers to claim WETH and swap it to alETH. If the swap path or the amount is predictable, it could be front-run by an attacker to manipulate the swap rate.

Vulnerability Details:

  • Severity: MEDIUM

  • Explanation: The claimAndSwap function allows keepers to claim WETH and swap it to alETH. If the swap path or the amount is predictable (i.e. if any user next to claim and swap the tokens, can predict the swap rate and place the order to swap his respective tokens), it could be front-run by an attacker to manipulate the swap rate.

Impact:

Front-running attacks could lead to unfavorable swap rates and potential loss of funds. Since an attacker can predict the swap rate, making it easier and more predictable for him to detect the HIGHEST swap rate and place the swap order for these tokens whenever the swap rate is HIGH, resulting in favorable swap rates for the attacker and unfavorable for other users and for the protocol itself.

Tools Used:

Manual Testing

Recommendations:

Implement mechanisms to randomize or obscure the swap path and amounts, or use a decentralized exchange with anti-front-running measures. Below updated code of StrategyOp::claimAndSwap function implements the randomize mechanism.

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IVeloRouter.route[] calldata _path) external onlyKeepers nonReentrant {
//...existing code...
​
// Randomize or obscure the swap path and amounts
IVeloRouter.route[] memory randomizedPath = randomizePath(_path);
//...existing code...
​
function randomizePath(IVeloRouter.route[] calldata _path) internal view returns (IVeloRouter.route[] memory) {
// Implement logic to randomize or obscure the swap path
// replace with actual logic
return _path; // Replace with actual randomized path
}
Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.