Alchemix Transmuter

Issue:

The claimAndSwap function lacks validation of the _amountClaim parameter against the actual claimable balance from the ITransmuter. If a Keeper provides an _amountClaim greater than the getClaimableBalance() for the strategy, the call to transmuter.claim() may revert, disrupting operations or creating inefficiencies.

Impact:

Medium to High.

1. Operational Disruption: If _amountClaim exceeds the claimable amount, the function will revert, preventing swaps from proceeding and halting yield generation.

2. Keeper Costs: Reverting transactions consume gas, leading to inefficiencies for Keepers performing valid operations.

3. Systemic Impact: Continuous reverts can destabilize the strategy, leading to delayed fund rebalancing or misaligned user expectations for yield.

Evidence from Code:

The transmuter.claim() call directly uses _amountClaim without validating it against transmuter.getClaimableBalance(address(this)).

Potential Attack or Mismanagement Scenarios:

1. Overestimated Claims by Keepers:

   • A Keeper unintentionally or maliciously specifies _amountClaim greater than getClaimableBalance().

   • The transmuter.claim() function reverts, wasting gas and interrupting the strategy's operations.

2. Repeated Reverts Leading to DoS:

   • Multiple calls with invalid _amountClaim values can lead to a Denial-of-Service (DoS) condition where valid swaps are delayed or entirely blocked.

3. Exploitation of Revert Behavior:

   • An attacker manipulates Keepers into repeatedly submitting invalid _amountClaim values, causing operational disruptions.

Proposed Mitigations:

1. Validation Check for _amountClaim: Ensure that _amountClaim does not exceed the claimable balance.

   require(

   _amountClaim <= transmuter.getClaimableBalance(address(this)),

   "Invalid claim amount"

   );

   ​

2. Graceful Fallback Mechanism: If _amountClaim exceeds the claimable balance, adjust it dynamically to the available balance.

   uint256 claimable = transmuter.getClaimableBalance(address(this));

   uint256 amountToClaim = _amountClaim > claimable ? claimable : _amountClaim;

   transmuter.claim(amountToClaim, address(this));

   ​

Updated Function Implementation:

**Advantages of the fix **

1. Resilience: Prevents unnecessary transaction failures, ensuring the strategy continues operating even under adverse conditions.

2. Efficiency: Minimizes wasted gas from reverts, reducing operational costs for Keepers.

3. Transparency: Logs adjustments and discrepancies, enhancing monitoring and debugging.