Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

The `claimAndSwap` function doesn't handle asset properly

godswillchiagorom20

Summary

The claimAndSwap function is designed to be called by a keeper to claim WETH from a transmuter contract and then swap it to alETH at a premium

Vulnerability Details

The function is design in a way in which under certain condition a keeper is triggered that perform a swap (WETH --> alETH) always at a gain. Observing the claimAndSwap function

/**
* @dev Function called by keeper to claim WETH from transmuter & swap to alETH at premium
* we ensure that we are always swapping at a premium (i.e. keeper cannot swap at a loss)
* @param _amountClaim The amount of WETH to claim from the transmuter
* @param _minOut The minimum amount of alETH to receive after swap
* @param _path The path to swap WETH to alETH (via Ramses Router)
*/
function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IRamsesRouter.route[] calldata _path) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
_swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}
​
​
​
​
function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IRamsesRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IRamsesRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}

Function Logic

  1. Claims an amount of WETH from the transmuter contract

  2. Ensure that the amount of alETH to receive is greater than the amount of WETH claimed

  3. Ensure that there is a enough WETH to handle the swap

  4. Perform the Swap

  5. Ensure that the resulting value from the swap is greater than the expectant value

  6. Deposit the asset back into the transmuter contract

However, during the deposit back to the transmuter contract the function sent the entire balance of the asset to the transmuter which can be unintended since the essence of the swap is to send the swap result back to the transmuter.

Impact

This is an over-deposit, the keeper is trusted to properly handle the swap with an intention to deposit the swap output back into the transmuter, however, more than what is being intended is deposit especially if the contract held some reasonable amount of asset in the contract. This is problematic because the intent is likely to deposit only the output of the swap, which is the amount received from swapping WETH to alETH.

Tools Used

Manual

Recommendations

Deposit only the swap result(balAfter - balBefore) back into the transmuter contract

Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.