Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Sandwich attacks could lead to unfavorable swaps in `claimAndSwap` function

0xmsf14

Summary

The claimAndSwap function relies on _minOut parameter to protect against slippage, but it uses a flawed check

  • The condition _minOut > _amountClaim only ensures you get more alETH than WETH, but doesn't account for market price

  • An attacker could manipulate the price right before the transaction, leading to unfavorable swaps

Vulnerability Details

  • The core vulnerability is in the claimAndSwap function's check:

require(_minOut > _amountClaim, "minOut too low");

  • This only ensures you get more alETH than WETH numerically, not by value

Attack Path

  • Monitor the mempool for keeper calls to claimAndSwap

  • Front-run the transaction by temporarily pumping the alETH price

  • Let the keeper's transaction execute at the manipulated price

  • Back-run by selling at the inflated price

  • Profit from the price difference

Impact

Malicious user can reduce the amount of AlETH claimed WETH can swap for, and profit off the depeg more than the protocol

Tools Used

Manual Review

Recommendations

  1. Implement proper price validation:

function claimAndSwap( uint256 _amountClaim, uint256 _minOut, uint256 _routeNumber ) external onlyKeepers
{ ``// Get current price from oracle`` uint256 currentPrice = getOraclePrice(); ``// Calculate minimum output based on current price with some tolerance`` uint256 expectedOutput = (_amountClaim * currentPrice) / 1e18; uint256 minAcceptableOutput = (expectedOutput * 98) / 100; ``// 2% slippage`` require(_minOut >= minAcceptableOutput, "Slippage too high"); ``// Rest of the function...`` }`
​
Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID]Lack of mechanism to ensure premium swaps

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.