Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Wrongly Deposit Whole Balance in `claimAndSwap` function After Swap

bladesec

Title

Wrongly Deposit Whole Balance in claimAndSwap function After Swap

Summary

The claimAndSwap function incorrectly deposits the entire alETH balance of the strategy contract instead of the swapped amount, potentially causing unexpected losses or mismanagement of protocol funds.

Vulnerability Details

Here's the implementation of claimAndSwap function of StrategyOp contract:

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IVeloRouter.route[] calldata _path ) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
​
_swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
>> transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

As seen above, it deposits whole balance of stratey contract via transmuter.deposit call. Technically, the swapped amount through the claim is balAfter - balBefore not the whole balance. This mistake could lead to depositing unintended funds, including any pre-existing asset token balance already held by the contract.

Impact

Unintended deposits of pre-existing asset token balances into the transmuter contract could lock funds, causing liquidity issues and disrupting the execution of subsequent operations.

Tools Used

Manual Review

Recommendations

Update the deposit amount as balAfter - balBefore:

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IVeloRouter.route[] calldata _path ) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
​
_swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
- transmuter.deposit(asset.balanceOf(address(this)), address(this));
+ transmuter.deposit(balAfter - balBefore, address(this));
}
Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.