Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Commented Critical `ClaimAndSwap` Logic Leading to Value Accumulation Risk

BugPull

Summary

The _harvestAndReport() function has critical claim and swap logic commented out, preventing proper conversion of claimed WETH to alETH and leading to value accumulation risks, and wrong reporting to strategy of currently earned yields

Vulnerability Details

if (claimable > 0) {
// transmuter.claim(claimable, address(this));
}
​
// NOTE : we can do this in harvest or can do seperately in tend
// if (underlying.balanceOf(address(this)) > 0) {
// _swapUnderlyingToAsset(underlying.balanceOf(address(this)));

The commented code prevents:

  1. Claiming available WETH from transmuter

  2. Converting claimed WETH to alETH at market premium

  3. Regular compounding of returns

This creates a value leak during reporting where claimable WETH remains idle instead of being converted to yield-bearing alETH.

wrong reported _totalAssets

Impact

Medium - The vulnerability affects core strategy mechanics:

  • deflated total assets reporting, since the claimable wETH is not accounted for as claimable (exchanged balance) and not swapped to alETH and then deposited to transmuter to reflect accurate balance

  • Incorrect profit calculations

  • Wrong performance fee charges

  • Inaccurate share price calculations

  • Potential economic loss for users through incorrect share pricing

The impact is amplified because report() in TokenizedStrategy.sol uses this value for critical accounting including:

  • Profit/loss calculations

  • Fee distributions

  • Share price updates

  • Profit unlocking mechanics

  • Lost reported yield from unconverted WETH

  • Reduced strategy performance

  • Inaccurate TVL reporting and accounting in TokenizedVault strategy

Tools Used

  • Manual code review

  • TokenizedVault of yearn contract context

Recommendations

  1. Uncomment and implement claim and swap logic:

function _harvestAndReport() internal override returns (uint256 _totalAssets) {
uint256 claimable = transmuter.getClaimableBalance(address(this));
if (claimable > 0) {
transmuter.claim(claimable, address(this));
// Immediately swap to capture premium
_swapUnderlyingToAsset(underlying.balanceOf(address(this)));
}
_totalAssets = transmuter.getUnexchangedBalance(address(this)) +
asset.balanceOf(address(this));
}
Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xhuntoor Submitter
8 months ago
0xhuntoor Submitter
8 months ago
inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.