Alchemix Transmuter

Summary

The function setRouter update a router by a new router however, the validity of the new router isn't checked during the update.
This can introduce a risk in which the new router may be uncapable of carrying out the swap operation.
Observing the function below

As seen, the function doesn't check the validity of the input parameter before setting approval

Vulnerability Details

The function does not check whether the provided _router is a valid contract or a router capable of performing the desired swap. A malicious or incorrect address could be set as the router, potentially leading to undesirable outcomes.

Impact

Setting an undesired address as the router pose serious risk

Tools Used

Manual

Recommendations

Perform check to ensure that the new Router being updated to is valid