Alchemix Transmuter

Summary

The StrategyArb contract contains a vulnerability where it automatically redeposits all arbitrage profits (in alETH) into the Transmuter without validating whether this action is economically beneficial under current market conditions. This forced redeposit mechanism may lead to a net loss if alETH is depegged, as it locks funds into an illiquid or undervalued position despite profitable arbitrage execution.

Vulnerability Details

When keeper calls claimAndSwap inside StrategyArb contract, it automatically redeposits all alETH back into the Transmuter after performing arbitrage swaps, without validating whether this redeposit is economically beneficial given current market conditions.

The issue occurs in three steps:

1. Claim: The strategy claims WETH from the Transmuter

2. Swap: It swaps WETH for alETH at a premium (which is correctly validated)

3. Forced Redeposit: It automatically redeposits ALL alETH back into the Transmuter without any checks

The _swapUnderlyingToAsset function does include a basic check:

However, this only ensures the initial swap is profitable but doesn't validate whether redepositing is optimal.

Example Scenario:

• Initial State:
  Strategy has 10 WETH claimed from Transmuter
  alETH is trading at 0.95 WETH (5% below peg)

• Arbitrage Execution:
  Keeper executes claimAndSwap(10 WETH, 10.5 alETH, path)
  Successfully swaps 10 WETH → 10.5 alETH (5% premium)

• Forced Redeposit:
  All 10.5 alETH is automatically redeposited to Transmuter
  If alETH remains depegged at 0.95 WETH:
  Redeposited alETH is valued at: 10.5 * 0.95 = 9.975 WETH
  Net loss: 0.025 WETH (compared to initial 10 WETH)

The strategy has effectively locked funds into an illiquid position at a disadvantageous price, despite successfully executing the initial arbitrage.

Impact

If alETH is still depegged, the redeposited funds may result in reduced value or illiquid positions.

Tools Used

Manual Review

Recommendations

Use an external oracle to fetch the current price of alETH relative to WETH and validate that redepositing alETH results in at least the same or higher value compared to holding WETH.