Alchemix Transmuter

Summary

The _freeFunds function interacts with the transmuter to free a specified amount of the 'asset' (e.g., alETH) by withdrawing it from the Transmuter contract. The function’s current design does not properly account for the availability of liquidity and could result in unintended behavior during times of high liquidity demand or low liquidity situations. This could lead to poor user experience or loss of funds for users attempting to withdraw during stressed conditions.

Vulnerability Details

The _freeFunds function has the potential to experience vulnerabilities when handling withdrawals in conditions of low or high liquidity demand. The function attempts to withdraw the full amount requested by the user, but if liquidity is insufficient in the transmuter, the withdrawal process may fail, causing a loss of funds or delay.

Key Vulnerabilities:

1. No Liquidity Checks for Withdrawals: The function doesn't validate whether the requested amount can actually be withdrawn, making it vulnerable to cases where withdrawals exceed available liquidity.

2. Excessive Withdrawals on Illiquid Assets: In times of illiquidity, withdrawing the full amount could cause slippage or lead to a failed withdrawal if the system cannot fulfill the entire request.

3. Failure to Handle Large Withdrawals: During high liquidity demand, if there is insufficient liquidity to cover large withdrawal requests, the system may behave unpredictably, either failing to return the full amount or causing incorrect accounting for the remaining balance.

Impact

Medium to High: Potential financial losses and platform instability due to failure in managing withdrawals in high liquidity demand scenarios.

Tools Used

Manual Review

Recommendations

Liquidity Validation: Implement a check to verify if the requested withdrawal amount is available in the transmuter before initiating the withdrawal. If insufficient liquidity is available, the contract should revert the transaction or return a partial amount.

Dynamic Withdrawal Amount Adjustment: Instead of attempting to withdraw the requested amount directly, the contract should attempt to gradually free the funds based on available liquidity and adjust accordingly to avoid triggering an unbalanced withdrawal.

Withdrawal Limits: Introduce a cap on the withdrawal amounts that can be freed within a single transaction to prevent liquidity exhaustion and ensure stability during times of high withdrawal demand.

Add Liquidity Warning Mechanism: Introduce mechanisms that notify users when liquidity is low, suggesting that they may need to wait or withdraw smaller amounts.