Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing logic throughout protocol

0xlandlady

Summary

The codebase contains multiple unimplemented TODOs and commented-out code sections across different contracts, particularly in critical functions. This incomplete implementation will prevent certain actions from being taken such as claiming, tending, and emergency withdrawals, and will cause the strategy to be unable to function as intended.

Vulnerability Details

In the all of the in scope contracts there are several instances of unfinished TODOs and commented-out code that could impact the security and functionality of the system:

  1. In the _harvestAndReport function:

if (claimable > 0) {
// transmuter.claim(claimable, address(this));
}

  1. In the availableDepositLimit function:

function availableDepositLimit(
address _owner
) public view override returns (uint256) {
TODO: If desired Implement deposit limit logic and any needed state variables .
EX:
uint256 totalAssets = TokenizedStrategy.totalAssets();
return totalAssets >= depositLimit ? 0 : depositLimit - totalAssets;
}

  1. In the _emergencyWithdraw function:

function _emergencyWithdraw(uint256 _amount) internal override {
TODO: If desired implement simple logic to free deployed funds.
​
EX:
_amount = min(_amount, aToken.balanceOf(address(this)));
_freeFunds(_amount);
}

The presence of these unimplemented sections indicates that critical functionality may be missing, including:

  • Proper claim handling in harvest operations

  • Deposit limits for risk management

  • Emergency withdrawal procedures

  • Proper swap validation and price checks

Impact

  • Missing deposit limits could lead to excessive capital concentration

  • Incomplete emergency withdrawal functionality could trap funds during critical situations

  • Unimplemented claim handling could result in lost yield

Tools Used

Manual Review

Recommendations

Implement all TODO sections with proper functionality as well as finish the commented out code.

Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.