Alchemix Transmuter

Description

When swapping WETH to alETH via _swapUnderlyingToAsset, the function checks conditions such as:

However, AMMs can apply varying fee structures (stable vs. volatile pairs, multi-hop routes, etc.). Meeting minOut in absolute terms doesn’t guarantee a favorable swap price if high fees are involved.

Impact: Medium to High

1. Hidden High Fees

   • A keeper could select a path that meets the minOut threshold yet still collects excessive fees. The strategy ends up accepting worse pricing.

2. No External Reference Price

   • Without an oracle or robust slippage check, the contract merely trusts the keeper’s minOut value, opening the door to suboptimal trades.

3. User Funds at Risk

   • Over time, repeated fee-heavy routes reduce overall yield and can erode the value of user deposits.

Evidence from Code

An example snippet from _swapUnderlyingToAsset:

The code only checks that final output tokens exceed minOut. It does not verify the effective price paid when accounting for different fee tiers or multiple hops.

Potential Attack / Manipulation Scenario

1. Path with Elevated Fees

   • A keeper or malicious actor chooses a route that includes multiple high-fee pairs, fulfilling minOut but siphoning additional fees along the way.

2. Strategy Accepts Trade

   • Because _swapUnderlyingToAsset sees the final output surpasses minOut, it deems the trade acceptable, even if a substantial portion of the swap value went to fees.

3. Cumulative Value Loss

   • Frequent high-fee swaps degrade the strategy’s returns, hurting depositors.

Recommended Mitigations

1. Reference an On-Chain Oracle or Price Feed

   • Ensure that the final swapped amount is within a small slippage range relative to an oracle-based fair price:

     // Pseudocode:

     uint256 fairPriceOutput = _amount * oraclePrice / 1e18;

     require((balAfter - balBefore) >= fairPriceOutput * (100 - maxSlippageBasisPoints) / 10000, "Excessive slippage");

     ​

2. Enforce Stricter Slippage / Fee Controls

   • Instead of only relying on minOut, incorporate a logic that calculates an acceptable slippage limit for the current market conditions and fees.

3. Whitelist or Validate Swap Paths

   • Restrict swap paths to known, reputable pools with predictable or minimal fees, preventing keepers from routing through obscure or high-fee pools.

4. Limit Multi-Hop Paths

   • If possible, reduce the number of hops in the swap route to lower total fees.