Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Unimplemented Functionalities and TODO's that needs to be resolved

tanishqsharma612

Summary

Incomplete Implementation with TODO Comments

Vulnerability Details

The contract contains functionalities that are partially implemented and left with TODO comments, indicating missing logic. There are multiple instances which is having TODO comments.

Instances found in StrategyMainnet.sol

Instance 1:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L223

function availableWithdrawLimit(
address /*_owner*/
) public view override returns (uint256) {
// NOTE: Withdraw limitations such as liquidity constraints should be accounted for HERE
// rather than _freeFunds in order to not count them as losses on withdraws.
​
@> // TODO: If desired implement withdraw limit logic and any needed state variables.
​

Instance 2:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L268

function availableDepositLimit(
address _owner
) public view override returns (uint256) {
@> TODO: If desired Implement deposit limit logic and any needed state variables .

Instance 3:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyMainnet.sol#L331

function _emergencyWithdraw(uint256 _amount) internal override {
@> TODO: If desired implement simple logic to free deployed funds.
​
EX:
_amount = min(_amount, aToken.balanceOf(address(this)));
_freeFunds(_amount);
}
Instances found in StrategyArb.sol

Instance 1:

Important functionality to check oracle pricing before swap is left as incomplete

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L82
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L83

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IRamsesRouter.route[] calldata _path) internal {
@> // TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");

Instance 2:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L202

function availableWithdrawLimit(
address /*_owner*/
) public view override returns (uint256) {
// NOTE: Withdraw limitations such as liquidity constraints should be accounted for HERE
// rather than _freeFunds in order to not count them as losses on withdraws.
​
@> // TODO: If desired implement withdraw limit logic and any needed state variables.
​

Instance 3:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L82

function availableDepositLimit(
address _owner
) public view override returns (uint256) {
@> TODO: If desired Implement deposit limit logic and any needed state variables .
EX:
uint256 totalAssets = TokenizedStrategy.totalAssets();
return totalAssets >= depositLimit ? 0 : depositLimit - totalAssets;

Instance 4:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L310

function _emergencyWithdraw(uint256 _amount) internal override {
@> TODO: If desired implement simple logic to free deployed funds.
​
EX:
_amount = min(_amount, aToken.balanceOf(address(this)));
_freeFunds(_amount);
Instances found in StrategyOp.sol

Instance 1:

Important functionality to check oracle pricing before swap is left as incomplete

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L96
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L97

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
@> // TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");

Instance 2:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L205

function availableWithdrawLimit(
address /*_owner*/
) public view override returns (uint256) {
// NOTE: Withdraw limitations such as liquidity constraints should be accounted for HERE
// rather than _freeFunds in order to not count them as losses on withdraws.
​
@> // TODO: If desired implement withdraw limit logic and any needed state variables.
​

Instance 3:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L250

function availableDepositLimit(
address _owner
) public view override returns (uint256) {
@> TODO: If desired Implement deposit limit logic and any needed state variables .
EX:
uint256 totalAssets = TokenizedStrategy.totalAssets();
return totalAssets >= depositLimit ? 0 : depositLimit - totalAssets;

Instance 4:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L313

function _emergencyWithdraw(uint256 _amount) internal override {
@> TODO: If desired implement simple logic to free deployed funds.
​
EX:
_amount = min(_amount, aToken.balanceOf(address(this)));
_freeFunds(_amount);
Instances found in StrategyAprOracle.sol

Instance 1:

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/periphery/StrategyAprOracle.sol#L32

function aprAfterDebtChange(
address _strategy,
int256 _delta
) external view override returns (uint256) {
@> // TODO: Implement any necessary logic to return the most accurate
// APR estimation for the strategy.
return 1e17;
}

Impact

There are many instances in the codebase which shows that the code still have many functionalities that needs to be completed.

Tools Used

Manual Review

Recommendations

All the Incomplete Implementation and TODO's should need to be resolved

Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.