Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Asset Accounting in Harvest Report Leading to Share Price Manipulation

BugPull

Summary

The _harvestAndReport() function incorrectly calculates total assets by double counting underlying tokens and missing claimable balances, leading to inaccurate profit/loss reporting.

Vulnerability Details

In _harvestAndReport(), the total assets calculation is:

_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;

Two key issues:

  1. underlyingBalance should not be included since underlying tokens (WETH) are immediately swapped to asset (alETH) in claimAndSwap()

  2. The function misses claimable balance from the transmuter which represents exchanged tokens that can be claimed

The correct calculation should be:

_totalAssets = unexchanged + asset.balanceOf(address(this)) + claimable;

Impact

  • Incorrect total assets reporting leads to wrong profit/loss calculations in the TokenizedStrategy's report() function

  • This affects:

    • Performance fee calculations

    • Share price calculations

    • Profit unlocking mechanism

  • Users may receive wrong share amounts when depositing/withdrawing

  • Protocol fees may be calculated incorrectly

Tools Used

  • Manual code review

  • Understanding of TokenizedStrategy's report() mechanism

Recommendations

  1. Remove underlyingBalance from total assets calculation

  2. Add claimable balance to the total:

function _harvestAndReport() internal override returns (uint256 _totalAssets) {
uint256 claimable = transmuter.getClaimableBalance(address(this));
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
_totalAssets = unexchanged + asset.balanceOf(address(this)) + claimable;
}
Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect accounting in `_harvestAndReport` claimable should be included

_harvestAndReport should not contain the underlying balance to prevent donations having an impact.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect accounting in `_harvestAndReport` claimable should be included

Dormant WETH is not properly treated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.