Alchemix Transmuter

Summary

The strategy contract grants maximum token approval to the transmuter and router to facilitate seamless interactions. However, if either the transmuter or router is compromised, an attacker could exploit the unlimited approval to drain tokens from the strategy contract.

Vulnerability Details

The strategy contract simplifies interactions by granting unlimited token approval to the transmuter and router:

If the transmuter or router contracts are exploited, an attacker can transfer or drain all approved tokens from the strategy contract, potentially resulting in the loss of all user-deposited funds managed by the strategy.

Impact

All tokens in the strategy contract could be drained by an attacker exploiting the transmuter or router.

Tools Used

Manual Review

Recommendations

Avoid granting unlimited token approval. Instead, approve only the required amount for each transaction.