Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

availableWithdrawLimit function does not accout for all available assets in strategy

valy001

Summary

The function availableWithdrawLimit does not account for all available withdraw assets.

Vulnerability Details

The availableWithdrawLimit is derived from baseStrategy contract and is overriding to set a upper limit for withdraw amout when user trying to withdraw or redeem their assets. However, this function only accout for current avaible alTokens from strategy contract and Alchemix transmuter.

Since the assets user deposited are instantly deposited into transmuter, this makes the implemented logic available limit mostly equal to transmuter.getUnexchangedBalance.

The transmuter machanism gradully exchange alToken to underlying token when time flys. This makes the withdraw limit lesser and lesser as time goes. If a user is trying to withdraw his alToken, most of the deposited assets in strategy has turned into claimable underlying token. He may not get his funds back.

function availableWithdrawLimit(
address /*_owner*/
) public view override returns (uint256) {
// NOTE: Withdraw limitations such as liquidity constraints should be accounted for HERE
// rather than _freeFunds in order to not count them as losses on withdraws.
​
// TODO: If desired implement withdraw limit logic and any needed state variables.
​
// EX:
// if(yieldSource.notShutdown()) {
// return asset.balanceOf(address(this)) + asset.balanceOf(yieldSource);
// }
// NOTE : claimable balance can only be included if we are actually allowing swaps to happen on withdrawals
//uint256 claimable = transmuter.getClaimableBalance(address(this));
return asset.balanceOf(address(this)) + transmuter.getUnexchangedBalance(address(this));
}

Impact

Users may not be able to withdraw their alToken back if most of the deposits are turned into underlying tokens and locked in transmuter.

Tools Used

manual

Recommendations

claim from transmuter and consider accout for all the available assets.

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.