Alchemix Transmuter

Router update fails to remove all the previous token allowances of StrategyOp and StrategyArb from the previous router implementation.

StrategyOp safe approves all of it's underlying token to the router

File: https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L38-L41

StrategyArb safe approves all of it's underlying token to the router

File: https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L34-L39

setRouter function can be used to update the router implementation at will by the managment

Files:

• https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L42-L45

• https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L48-L51

  function setRouter(address _router) external onlyManagement {
  router = _router;
  underlying.safeApprove(router, type(uint256).max);
  }

The Strategy contract at no point in time removes the allowances from the old router. This results in old router instances still having spending rights on the respective Strategies underlying tokens.

Impact
Old router instances still have spending routes over the Strategies respective tokens and given that, some of these routers are upgreadable, it opens a potential door through which the protocol or a devious hacker can rug pull everyone if they have access to the old router admin rights.

Recommended Mitigation
We should remove the allowances of the old router before updating it in the setRouter function