Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Underlying token is not converted to asset token decimals, which breaks the Strategy for alUSD transmuters.

touthang

Summary

As we can see Alchemix has alETH and alUSD transmuters here.
If we look at the alUSD transmuters, we can find the it also has USDC and USDT as underlying which has only 6 decimals.

The problem is Strategy is not compatible with these tokens because it doesn't convert their decimals to alUSD decimal.

Vulnerability Details

function balanceDeployed() public view returns (uint256) {
return transmuter.getUnexchangedBalance(address(this)) + underlying.balanceOf(address(this)) + asset.balanceOf(address(this));
}
function _harvestAndReport()
internal
override
returns (uint256 _totalAssets)
{
​
uint256 claimable = transmuter.getClaimableBalance(address(this));
​
if (claimable > 0) {
// transmuter.claim(claimable, address(this));
}
​
// NOTE : we can do this in harvest or can do seperately in tend
// if (underlying.balanceOf(address(this)) > 0) {
// _swapUnderlyingToAsset(underlying.balanceOf(address(this)));
// }
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
​
// NOTE : possible some dormant WETH that isn't swapped yet
uint256 underlyingBalance = underlying.balanceOf(address(this));
​
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
}

For the balanceDeployed function it is not much of a problem because it doesnt do anything else, it will just return the wrong balance.
But for the _harvestAndReport function, the return value is to be used by report() to examine profit/loss, and since underlyingBalance is not converted to 1e18 decimals it will return a lot less value then the actual amount and the ```report`` will be executed with an invalid new totalAssets which breaks the share to asset ratio.

Impact

High: it breaks the profit/loss acountiing of the Strategy.

Tools Used

manual

Recommendations

implement a decimal conversion in the given functions from 6 to 18, for Strategies using alUSD transmuters.

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.