Alchemix Transmuter

Summary

The claimAndSwap in all strategies instantly increases the unexchanged balance. This way an attacker can deposit a large amount of assets before the claimAndSwap call and receive a significant part reward for the previous period by redeeming right after the call. All the strategies in the scope have this vulnerability.

Vulnerability Details

The claimAndSwap function increases the unexchanged balance, i.e. increases the amount of assets per share when withdrawal. So to receive more rewards an attacker just deposits assets right before the claimAndSwap being called.

Impact

The impact fully depends on the time periods between the claimAndSwap calls and is nearly medium but the attack path is quite simple, so the likelihood is high.

Tools used

Manual Review

Recommendations

Consider reporting the reward amount in a similar with the TokenizedStrategy.report function way which guarantees slowly unlocking of the profit. Another mitigation way is making the claimAndSwap function internal and invoking as a part of the _harvestAndReport logic or always calling the report function right after claimAndSwap.