Alchemix Transmuter

Summary

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol

In the _harvestAndReport() function, the claimable portion is not included in the calculation of the total assets. Specifically, the function calculates the total assets as:

unexchanged + asset.balanceOf(address(this)) + underlying.balanceOf(address(this));

However, it retrieves the claimable amount using:

uint256 claimable = transmuter.getClaimableBalance(address(this));

but does not include claimable in the total assets calculation. Since claimable represents WETH that can be claimed by the strategy, omitting it causes an underestimation of the strategy’s actual holdings. This can lead to inaccurate profit/loss reporting, creating either “false” losses or imprecise gains in accounting.

Vulnerability Details

Impact

Tools Used

Recommendations

_totalAssets = claimable + unexchanged + asset.balanceOf(address(this)) + underlyingBalance;