Alchemix Transmuter

Summary

The setRouter function allows the management to update the router address used for token swaps (WETH to alETH) via the VeloRouter. If misused or maliciously controlled, a rogue router could lead to unexpected token swaps, potentially resulting in the loss of funds or unfair manipulation of token prices.

Vulnerability Details

The setRouter function is permissioned, only accessible by management. However, if the management account is compromised or poorly managed, an attacker could change the router address to a malicious contract.

• This allows the strategy to swap tokens at malicious rates or direct tokens to an unauthorized address, causing loss of assets or manipulated swap conditions.

• The router address is approved with unlimited spending, increasing the risk of unauthorized transactions if the router is changed to a rogue contract.

Impact

Severity: High

Likelihood: Medium

Impact: High

Proof of Concept (PoC):

1. Attacker Gains Control Over Management Role

2. Exploiting the Vulnerability: After the attacker becomes the manager, they can call setRouter to change the router address to one of their choosing, enabling them to potentially redirect all asset swaps or transactions to a malicious contract.

Example PoC:

Attack Flow:

1. The attacker, having control over the management role, calls setRouter to replace the legitimate router address with a malicious router address.

2. Once the router is changed, the malicious router could:

   • Redirect asset transfers to the attacker's wallet.

   • Manipulate swaps or other financial operations within the strategy.

Tools Used

Manual Review

Recommendations

1. Multi-sig Control: Use a multi-signature wallet for the management role that has control over the router address. This will require multiple approvals before any router update can be made, reducing the risk of a single compromised key.

2. Time-lock for Changes: Implement a time-lock on changes to the router address. This gives stakeholders time to react in case of suspicious activity before the change takes effect.

3. Pre-Approval Checks: Before changing the router, ensure that it is validated against a list of known and approved routers, possibly using a registry pattern.

4. Revoke Unused Approvals: After the router is updated, ensure that the old router has its approvals revoked. This will prevent the old router from continuing to interact with the contract after it is replaced.