Alchemix Transmuter

Summary

The strategy's StrategyMainnet::_harvestAndReport() function updates _totalAssets in a step-wise manner during report() calls rather than continuously tracking accrued profits, creating MEV opportunities for sandwich attacks around profit reporting transactions.

Note!: This bug assumed other low severity bugs to be solved about underlying wring accounting

Vulnerability Details

In _harvestAndReport():

The issue:

1. Profits accrue continuously in the transmuter

2. _totalAssets only updates during report() or during normal deposit(), withdraw()

3. Creates predictable jumps in share price

4. MEV bots can sandwich the report transaction

Attack Path:

1. Monitor claimable balance off-chain

2. When significant profits accrue:

   • Front-run report() with deposit

   • Let report() execute and increase share price

   • Back-run with withdrawal at higher share price

   • Extract profit from price difference

Impact

• MEV bots can extract value from legitimate users

• Unfair profit distribution

• Reduced returns for long-term holders

• Potential for coordinated sandwich attacks

Tools Used

• Manual code review

• Understanding of MEV mechanics

• Analysis of TokenizedStrategy profit reporting

Recommendations

1. Implement continuous profit tracking:

1. Add rate-limiting or timelock on deposits/withdrawals around reports

2. Consider implementing anti-MEV measures like:

   • Minimum holding periods

   • Deposit/withdrawal fees

   • Time-weighted profit distribution