Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

`amountOut` larger than `amount` in `claimAndSwap` is not of enough protection

BugPull

Summary

The strategy's _swapUnderlyingToAsset function has insufficient price validation when swapping WETH to alETH, only requiring the output amount to be greater than input by 1 wei. This allows potential MEV exploitation and value extraction from the strategy.

Vulnerability Details

The vulnerability exists in the _swapUnderlyingToAsset function:

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IRamsesRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
require(minOut > _amount, "minOut too low");
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IRamsesRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}

The key issues are:

  1. The function only requires minOut > _amount, meaning a swap returning just 1 wei more than input is considered valid

  2. There's no oracle price validation despite TODO comment indicating it should check "price is better than 1:1"

  3. The keeper can execute trades at minimal premium, potentially extracting value through MEV

Impact

Low severity impact as it allows:

  • Keepers to execute unfavorable trades for the strategy (keepers are trusted any ways, but further checks should be applied)

  • Value extraction through MEV sandwich attacks especially if sequencer got decentralized

  • Loss of value for strategy users since trades can execute at minimal premium instead of market rate premium

Tools Used

  • Manual code review

Recommendations

  1. Implement oracle price validation:

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IRamsesRouter.route[] calldata _path) internal {
uint256 oraclePrice = getOraclePrice(); // Get current WETH/alETH price
uint256 minAcceptableOut = (_amount * oraclePrice * 101) / (100 * 1e18); // 1% above oracle price
require(minOut >= minAcceptableOut, "insufficient output amount");
// ... rest of function
}

  1. Add slippage protection parameters:

  • Minimum acceptable premium percentage

  • Maximum allowed deviation from oracle price

  • Configurable by management

  1. Add events to track swaps and prices for monitoring

Updates

Lead Judging Commences

inallhonesty Lead Judge
11 months ago

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID]Lack of mechanism to ensure premium swaps

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!