Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect accounting for total assets in _harvestAndReport method

valy001

Summary

The internal function _harvestAndReport does not account for all the balance of strategies.

Vulnerability Details

All three strategies(mainnet/Arb/Op) derive from baseStrategy contract, where the overrided internal function _harvestAndReport is to harvest yields from sources and account for all the balance the strategy possesses and return summation of currently holded assets. The function logic is meant to first claim claimable underlyings from transmuter and sum up all unexchanged from transmulter and the balance of asset of contract held.

However, claimble part logic is commented out in StrategyMainnet.sol and is not implemented in StrategyOp and StategyArb, which will cause incorrect calculation of the total assets.

Impact

This function is call when mint new shares or withdraw assests as to calculate the split of vault share and accumulated assets . With wrong value returned , this could cause user to loose funds.

Tools Used

manual

Recommendations

consider uncommend the line

transmuter.claim(claimable, address(this));

as to:

function _harvestAndReport()
internal
override
returns (uint256 _totalAssets)
{
​
uint256 claimable = transmuter.getClaimableBalance(address(this));
​
if (claimable > 0) {
+ transmuter.claim(claimable, address(this)); //@audit uncomment
}
​
// NOTE : we can do this in harvest or can do seperately in tend
// if (underlying.balanceOf(address(this)) > 0) {
// _swapUnderlyingToAsset(underlying.balanceOf(address(this)));
// }
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
// NOTE : possible some dormant WETH that isn't swapped yet (although we can restrict to only claim & swap in one tx)
uint256 underlyingBalance = underlying.balanceOf(address(this));
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance; //@audit the claimable?
}
​
Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect accounting in `_harvestAndReport` claimable should be included

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.