Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Valid

Deposits during the strategy shutdown

pontifex

Summary

The claimAndSwap function does not check the shutdown status of the strategy and deposits assets continuously but the deposits should be stopped. All the strategies in the scope have this vulnerability.

Vulnerability Details

The TokenizedStrategy prevents deposits when the strategy is shutdown.

function _maxDeposit(
StrategyData storage S,
address receiver
) internal view returns (uint256) {
// Cannot deposit when shutdown or to the strategy.
>> if (S.shutdown || receiver == address(this)) return 0;

The claimAndSwap function ignores the shutdown status of the strategy and deposits asset tokens to the transmuter instead of collecting them at the contract:

function claimAndSwap(
uint256 _amountClaim,
uint256 _minOut,
uint256 _routeNumber
) external onlyKeepers {
transmuter.claim(_amountClaim, address(this));
uint256 balBefore = asset.balanceOf(address(this));
require(_minOut > _amountClaim, "minOut too low");
​
router.exchange(
routes[_routeNumber],
swapParams[_routeNumber],
_amountClaim,
_minOut,
pools[_routeNumber],
address(this)
);
uint256 balAfter = asset.balanceOf(address(this));
require((balAfter - balBefore) >= _minOut, "Slippage too high");
>> transmuter.deposit(asset.balanceOf(address(this)), address(this));
}

Impact

Unintended behavior, potential asset losses.

Tools used

Manual Review

Recommendations

Consider collecting asset tokens at the contract balance when the strategy is in the shutdown status instead of depositing it to the transmuter.

Updates

Lead Judging Commences

inallhonesty Lead Judge
8 months ago

Appeal created

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
pontifex Submitter
7 months ago
inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

deposits during shutdown

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.