No incentive to call transmute() instead of forceTransmute(self)

[code423n4]

Handle

cmichel

Vulnerability details

The difference between the Transmuter.transmute function and calling forceTransmute(self) on the own account is that transmute reallocates any excess yield to all other stakers, while forceTransmute pays out the excess yield to the user.

"One interesting side effect of this process is that a user's position can be over-filled. For example, a user deposits 1000 alUSD, and some time later, that staking position will have 1050 DAI filled. Once a user has gone past this limit, it is possible for other users to initialize a claim on their behalf. For any balance of DAI over their staked alUSD, the user who claimed on their behalf will have that surplus in amount immediately convert their staked alUSD." (forceTransmute) vs " If the person who staked the alUSD claims their DAI with a surplus, the surplus will be cycled back into the Transmuter and be spread globally." (transmute) https://alchemix-finance.gitbook.io/alchemix-finance/transmuter

Impact

There doesn't seem to be an economic incentive for rational agents to call transmute instead of just force-transmuting themselves.

Recommended Mitigation Steps

Remove the transmute function or remove forceTransmute and make its behavior the default for transmute.

[Xuefeng-Zhu]

forceTransmute require wait for a longer time, so it is not equivalent totransmute