Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: low
Valid

The underlying asset approval value of the old router is not reset to zero when calling `setRouter`

zhuying

Summary

The underlying asset approval value of router is set to type(uint256).max by default. When setting new router by calling setRouter, the underlying asset approval value of old router is not reset to zero.

Vulnerability Details

In constructor function, the _initStrategy function is called.

function _initStrategy() internal {
router = 0xAAA87963EFeB6f7E0a2711F397663105Acb1805e;
underlying.safeApprove(address(router), type(uint256).max);
}
function _initStrategy() internal {
router = 0xa062aE8A9c5e11aaA026fc2670B0D65cCc8B2858;
underlying.safeApprove(address(router), type(uint256).max);
}

It approves router address with max underlying asset approval value.
The router address can be changed by calling setRouter.

function setRouter(address _router) external onlyManagement {
router = _router;
underlying.safeApprove(router, type(uint256).max);
}

In setRouter function, the old router's underlying asset approval value isn't reset to zero.
The default router for arb chain is 0xAAA87963EFeB6f7E0a2711F397663105Acb1805e (proxy contract).
The default router for op chain is 0xa062aE8A9c5e11aaA026fc2670B0D65cCc8B2858.
If the old router is proxy, malicious attacker can upgrade the implementation contract of proxy contract and steal funds in Strategy contract using max underlying asset approval.

Impact

The funds in Strategy contract may be lost.

Tools Used

manual

Recommendations

function setRouter(address _router) external onlyManagement {
+ underlying.safeApprove(router, 0);
router = _router;
underlying.safeApprove(router, type(uint256).max);
}
Updates

Appeal created

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Old router approval is not revoked after an update

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Old router approval is not revoked after an update

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.