Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Idle Asset Exposure and Unconverted Asset Risk in _harvestAndReport Function

nitinaimshigh

Summary

The function calculates and reports the total assets held by the strategy, but it does not perform any action to ensure that idle or unconverted assets (such as dormant WETH) are appropriately managed or swapped to more productive assets.

Vulnerability Details

function _harvestAndReport()
internal
override
returns (uint256 _totalAssets)
{
​
uint256 claimable = transmuter.getClaimableBalance(address(this));
​
if (claimable > 0) {
// transmuter.claim(claimable, address(this));
}
​
// NOTE : we can do this in harvest or can do seperately in tend
// if (underlying.balanceOf(address(this)) > 0) {
// _swapUnderlyingToAsset(underlying.balanceOf(address(this)));
// }
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
​
// NOTE : possible some dormant WETH that isn't swapped yet
uint256 underlyingBalance = underlying.balanceOf(address(this));
​
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
}
​

  • The function calculates the total assets by summing the unexchanged balance, asset balance, and underlying token balance.

  • However, it does not address the potential for "idle" assets, such as unconverted WETH, to accumulate within the contract, which may expose the strategy to unnecessary risk if those assets experience price fluctuations.

  • The commented-out lines suggest that the strategy was designed to swap any idle assets into the main asset (alETH) but this is not being executed. Without converting idle assets, the strategy exposes itself to market risks, including potential losses if asset prices change unfavorably.

Impact

Medium to High Impact

Market Risk Exposure

Tools Used

Manual Review

Recommendations

  1. Ensure Idle Assets Are Converted

  2. Automate Conversions: Consider re-enabling and implementing the logic for _swapUnderlyingToAsset or similar functions to ensure that all unconverted assets are swapped into productive assets or used for further yield generation.

Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

_harvestAndReport should not contain the underlying balance to prevent donations having an impact.

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Dormant WETH is not properly treated

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.