Alchemix Transmuter

Issue: Approval Persists on Router Change

Description

When setRouter is called, the strategy grants an unlimited (type(uint256).max) allowance to the new router but never resets the allowance to the old router. Consequently, the outdated router retains an unlimited allowance even after it is no longer in use.

Impact: High

1. Unbounded Token Drains:
   A compromised or malicious old router can continue to transfer tokens at will, leading to potential large-scale token theft.

2. Expanded Attack Surface:
   Over time, multiple routers may accumulate max approvals, increasing the vulnerability footprint.

3. Protocol Funds at Risk:
   If an attacker controls any one previously approved router, they can drain the strategy’s underlying tokens.

Evidence from Code

Here, the old router’s type(uint256).max approval remains in place indefinitely.

Attack Scenario

1. Router Compromise:

   • The old router is compromised after setRouter updates the contract to a new router address.

2. Retained Allowance:

   • The compromised router still has type(uint256).max approval from the strategy contract.

3. Token Drain:

   • The attacker calls transferFrom repeatedly on the strategy’s underlying tokens to drain its balance.

Recommended Mitigation

1. Revoke Old Allowances Before Update

   function setRouter(address _router) external onlyManagement {

   // Revoke allowance from the current router

   underlying.safeApprove(router, 0);

   ​

   // Set the new router

   router = _router;

   // Grant a new allowance

   underlying.safeApprove(router, type(uint256).max);

   }

   ​

2. Consider a Timelock or Access Control

   • Adding a waiting period before finalizing a router change allows the community or team to vet the new router contract and detect potential malicious activity in time.

3. Whitelist / Registry of Trusted Routers

   • Restrict which addresses can be set as router to a predetermined set of verified, safe contracts.

Conclusion

By neglecting to reset the allowance on the old router, the strategy leaves itself exposed to a high-severity risk: a malicious or compromised router can remain approved for unlimited transfers. Implementing an explicit allowance revocation procedure before switching to a new router helps prevent unauthorized token movement and secures user funds.