Alchemix Transmuter

Summary

There are setRouterin StrategyArb and StrategyOp, which allows admins to update router address, however, approval for previous router is not revoked.

Vulnerability Details

Upon update, new router will be granted with max approval:

But we can notice, the approval of previous router is not revoked, this mean previous router still has max allowance on the strategy, while the routers themselves will not pose any threats to the protocol, it's still not a good practice to do so.

Impact

Router approval presists, in extreme edge case, if router is set to a malicious one, then such router can drain the strategy.

Tools Used

Manual review

Recommendations

When setting new router, also revoke previous approvals.