Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Events for Critical State Changes in Strategy Contracts

theblockchainer

Description

The strategy contracts (StrategyMainnet, StrategyOp, and StrategyArb) lack event emissions for critical state-changing operations. Events are essential for off-chain monitoring, transparency, and debugging. The following critical functions do not emit events:

  1. addRoute(): Adds new swap routes without tracking changes

  2. claimAndSwap(): Performs claims and swaps without logging results

  3. _freeFunds(): Withdraws funds without recording amounts

  4. _deployFunds(): Deploys funds without tracking deployments

  5. setRouter() (in StrategyOp/StrategyArb): Updates router without logging changes

Example from StrategyMainnet.sol:

function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
uint256 _routeNumber
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
// ... swap logic ...
transmuter.deposit(asset.balanceOf(address(this)), address(this));
// No event emitted
}

Impact

The lack of events has several negative implications:

  1. Monitoring Limitations:

    • Difficult to track strategy performance and operations

    • No way to monitor keeper activities and swap results

    • Cannot track successful/failed operations without parsing all transactions

  2. Debugging Challenges:

    • Complex to investigate failed transactions

    • No historical record of route additions or router changes

    • Difficult to audit actual vs expected behavior

  3. Integration Issues:

    • DeFi integrations cannot easily track strategy actions

    • Limited ability to build monitoring dashboards

    • No standardized way to track cross-chain operations

  4. Transparency Concerns:

    • Users cannot easily verify strategy operations

    • Limited visibility into keeper-executed swaps

    • No clear audit trail of management actions

Mitigation

Add appropriate events to the interface and emit them in all state-changing functions:

interface IStrategyInterface {
/// @notice Emitted when a new route is added to the strategy.
/// @param routeId_ The ID of the added route.
/// @param route_ The route configuration.
/// @param params_ The swap parameters.
/// @param pools_ The pool addresses.
event RouteAdded(
uint256 indexed routeId_,
address[11] route_,
uint256[5][5] params_,
address[5] pools_
);
​
/// @notice Emitted when funds are claimed and swapped.
/// @param amountClaimed_ The amount of underlying claimed.
/// @param amountReceived_ The amount of asset received.
/// @param routeId_ The route ID used for the swap.
event ClaimAndSwap(
uint256 amountClaimed_,
uint256 amountReceived_,
uint256 indexed routeId_
);
​
/// @notice Emitted when funds are freed from the strategy.
/// @param amount_ The amount requested to free.
/// @param amountFreed_ The actual amount freed.
event FundsFreed(uint256 amount_, uint256 amountFreed_);
​
/// @notice Emitted when funds are deployed.
/// @param amount_ The amount of funds deployed.
event FundsDeployed(uint256 amount_);
​
/// @notice Emitted when the router is updated.
/// @param oldRouter_ The previous router address.
/// @param newRouter_ The new router address.
event RouterUpdated(
address indexed oldRouter_,
address indexed newRouter_
);
}

Implementation example:

function claimAndSwap(
uint256 _amountClaim_,
uint256 _minOut_,
uint256 _routeNumber_
) external onlyKeepers {
transmuter.claim(_amountClaim_, address(this));
uint256 balBefore_ = asset.balanceOf(address(this));
​
router.exchange(...);
​
uint256 balAfter_ = asset.balanceOf(address(this));
transmuter.deposit(asset.balanceOf(address(this)), address(this));
​
emit ClaimAndSwap(
_amountClaim_,
balAfter_ - balBefore_,
_routeNumber_
);
}

These events will:

  1. Enable proper monitoring and tracking

  2. Facilitate debugging and auditing

  3. Improve transparency for users and integrators

  4. Follow EVM best practices

  5. Enable better analytics and dashboards

Updates

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.