Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

`claimAndSwap` function can be sandwich attacked

pontifex

Summary

The claimAndSwap in all strategies instantly increases the unexchanged balance. This way an attacker can deposit a large amount of assets before the claimAndSwap call and receive a significant part reward for the previous period by redeeming right after the call. All the strategies in the scope have this vulnerability.

Vulnerability Details

The claimAndSwap function increases the unexchanged balance, i.e. increases the amount of assets per share when withdrawal. So to receive more rewards an attacker just deposits assets right before the claimAndSwap being called.

function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
uint256 _routeNumber
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
require(_minOut > _amountClaim, "minOut too low");
​
router.exchange(
routes[_routeNumber],
swapParams[_routeNumber],
_amountClaim,
_minOut,
pools[_routeNumber],
address(this)
);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
>> transmuter.deposit(asset.balanceOf(address(this)), address(this));
}
<...>
function _freeFunds(uint256 _amount) internal override {
>> uint256 totalAvailabe = transmuter.getUnexchangedBalance(address(this));
if (_amount > totalAvailabe) {
transmuter.withdraw(totalAvailabe, address(this));
} else {
transmuter.withdraw(_amount, address(this));
}
}

Impact

The impact fully depends on the time periods between the claimAndSwap calls and is nearly medium but the attack path is quite simple, so the likelihood is high.

Tools used

Manual Review

Recommendations

Consider reporting the reward amount in a similar with the TokenizedStrategy.report function way which guarantees slowly unlocking of the profit. Another mitigation way is making the claimAndSwap function internal and invoking as a part of the _harvestAndReport logic or always calling the report function right after claimAndSwap.

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
pontifex Submitter
7 months ago
inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.