DeFiFoundrySolidity
16,653 OP
View results
Submission Details
Severity: low
Valid

`claimAndSwap` Function - Missing Validation on Strategy Shutdown status

Title

claimAndSwap Function - Missing Validation on Strategy Shutdown status

Summary

All Strategy contracts derived BaseStrategy which can be shutdown by the owner. Howver, claimAndSwap function doesn't check shutdown status of the contract which allows the swap operation could continue. This could result in unexpected lock of funds or mishavior.

Vulnerability Details

Here's the implementation of claimAndSwap function of StrategyOp contract:

function claimAndSwap(uint256 _amountClaim, uint256 _minOut, IVeloRouter.route[] calldata _path ) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
_swapUnderlyingToAsset(_amountClaim, _minOut, _path);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

As seen above, there's no check while performing claim and swap operation. It permit operation calls after shutdown, which allows a keeper to claim underlying tokens, swap them into the asset, and deposit them into the transmuter.

This unintentionally reintroduces assets into the system even after it has been marked as terminated.

Impact

Allowing operations like claimAndSwap after shutdown risks financial manipulation, system instability, and inaccurate asset tracking, potentially leading to unexpected losses or imbalances.
Furthermore, it undermines stakeholder trust, damages platform image, and decentivizes users' operations.

Tools Used

Manual Review

Recommendations

Consider blocking use of claimAndSwap function when the strategy is shutdown. TokenizedStrategy.isShutdown() can be used.

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

deposits during shutdown

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.