Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Valid

Old routers keep allowance on tokens of strategy, could result in unintened scam

mbushbush

Code Snippets

https://github.com/Cyfrin/2024-12-alchemix/blob/82798f4891e41959eef866bd1d4cb44fc1e26439/src/StrategyArb.sol#L44

Summary

In StrategyOp and StrategyArb contracts, setRouter function only focuses on new router address. By ignoring old router, it will still preserve the allowance (uint256.max).

Vulnerability Details

Here's setRouter function implementation:

function setRouter(address _router) external onlyManagement {
router = _router;
underlying.safeApprove(router, type(uint256).max);
}

The setRouter function updates the router but doesn’t revoke the old one’s access, risking unauthorized token use.

Impact

Failing to revoke the old router’s access leaves the protocol exposed to potential exploits, making it a ticking time bomb for unauthorized token drains.

Tools Used

Manual Review

Recommendations

Remove the allowance of previous router before updating to the new router address.

Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Old router approval is not revoked after an update

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.