Alchemix contest - shenwilly's results

Low Risk Vulnerabilities

1. Missing amount check in flushToAmo

There is no limit on how much amount a token can be flushed to Amo. A keeper can flush more than currentExchanged[underlyingToken] and expose users at risk of not being to claim their transmuted funds.

Recommended Mitigation Steps

Add a check before L334 to ensure that there is at least currentExchanged[underlyingToken] amount of token left after flushing, similar to the check done during depositing fund.

2. Missing sanity check when setting creditUnlockRate

When creditUnlockRate is set to zero, pending user credit won't be unlocked over time. This could happen when creditUnlockBlocks is set larger than FIXED_POINT_SCALAR.

Recommended Mitigation Steps

Consider adding sanity check to make sure blocks is lower than FIXED_POINT_SCALAR whenever creditUnlockRate is set:

• addYieldToken()
• configureCreditUnlockRate()

3. Missing sanity check on setFlashFee

Missing sanity check when setting flashMintFee. When accidently set to an unreasonable amount, unaware users might lose fund when flashminting.

Recommended Mitigation Steps

Add a reasonable maximum fee check:

function setFlashFee(uint256 newFee) external onlyAdmin {
    if (newFee > BPS / 2) { // max fee = 50%
        revert IllegalArgument();
    }
    ...
}

Affected code:

• AlchemicTokenV2.sol
• AlchemicTokenV2Base.sol