Alchemix Transmuter

Summary

The protocol fails to revoke token approvals from the old router when switching to a new one leaving unnecessary permissions that could be exploited by a compromised or outdated router

Vulnerability analysis

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyOp.sol#L48
https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L42

The setRouter function updates the router address used for token swaps but does not revoke the approval given to the old router. The approval remains active meaning the previous router still has access to perform token transfers even though it should no longer have access.

Impact

The old router still have access to the underlying token through the approval allowing malicious or unapproved use of the contract's assets

Tools Used

Manual Review

Recommendations

Before setting a new router address in the setRouter function, ensure that any approval granted to the previous router is revoked