Alchemix Transmuter

Description

When calling setRouter, the contract assigns router to the provided _router parameter and grants it an unlimited allowance (type(uint256).max). There is no check ensuring _router is a valid, nonzero, deployed contract address.

Impact: Medium

1. Potential Misconfiguration:

   • Accidentally setting router to address(0) causes subsequent approvals to point to an invalid address, breaking the strategy’s swap functionality.

2. Operational Failures:

   • Calls to external swap functions will fail or revert if router is address(0) or a non-contract address (no code at that address).

3. Downtime / Reduced User Confidence:

   • If the protocol depends on successful swaps, incorrectly setting the router disrupts user deposits, withdrawals, or yield operations until corrected.

Evidence from Code

The contract does not verify _router is a valid contract or even a nonzero address.

Attack / Failure Scenario

1. Malicious or Accidental Assignment:

   • The management (or a compromised management key) sets router to address(0) or any other invalid address.

2. Invalid Approval:

   • The contract grants underlying.safeApprove(router, type(uint256).max), but router is not a functional contract.

3. Functional Breakage:

   • When the strategy attempts to perform swaps or claims, the calls revert or do nothing. The protocol’s operations are effectively frozen until a valid router is set again.

Note that while this specific mistake doesn’t directly allow an attacker to drain funds (like an approval to a malicious contract), it can cause a severe denial-of-service on swapping functionality, harming user experience and protocol reliability.

Recommended Mitigations

1. Validate Nonzero Address

   require(_router != address(0), "Router cannot be zero address");

   ​

   • A simple check ensures you never set router to address(0).

2. Check extcodesize to Confirm Deployed Contract

   uint256 codeSize;

   assembly {

   codeSize := extcodesize(_router)

   }

   require(codeSize > 0, "Router must be a contract");

   ​

   • Ensures _router is a live, deployed contract rather than an EOA (Externally Owned Account) or empty address.

3. Consider a Timelock / Multi-Sig for Router Changes

   • Prevents quick or unauthorized updates to such a critical piece of infrastructure.