Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Valid

`StrategyMainnet` lacks deadline protection over router exchange

bladesec

Title

StrategyMainnet lacks deadline protection over router exchange

Summary

Unlike StrategyOp and StrategyArb contracts, where swap operations are protected by deadline, StrategyMainnet lacks deadline protection over router exchange.

Vulnerability Details

Here's the implementation of claimAndSwap function of StrategyMainnet contract:

function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
uint256 _routeNumber
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
require(_minOut > _amountClaim, "minOut too low");
​
>> router.exchange(
routes[_routeNumber],
swapParams[_routeNumber],
_amountClaim,
_minOut,
pools[_routeNumber],
address(this)
);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

As seen above, router.exchange function doesn't have any deadline paramter passed which makes it vulnearble to malicious attackers either through front-running or pool manipulation.

As opposed to that, StrategyOp and StrategyArb contracts have the deadline protection in place:

function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");
​
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
>> IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}

This discrepancy highlights not only inconsistencies in strategy implementation but also the absence of a slippage protection mechanism during router exchanges, potentially resulting in fund losses from premium swaps and affecting overall strategy operations.

Impact

The lack of consistency in StrategyMainnet implementation and the absence of slippage protection expose the protocol to significant risks, including potential fund losses during premium swaps and compromised strategy operations, which could severely impact user assets and overall protocol reliability.

Tools Used

Manual Review

Recommendations

Consider adding deadline protection like in StrategyOp contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

claimAndSwap should have slippage on Mainnet

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.