QuantAMM

Title

Inadequate Check in removeLiquidityProportional Allows Malicious Attacker to Withdraw More Than Their Deposit

Summary

The removeLiquidityProportional function lacks proper validation of withdrawal amounts, allowing malicious attackers with minimal deposits to exploit the system and withdraw more than they are entitled to.

Vulnerability Details

Here's the implementation of removeLiquidityProportional function in UpliftOnlyExample contract:

As demonstrated, the removeLiquidityProportional function verifies if the caller has deposits in the specified pool by checking the length of poolsFeeData[msg.sender].

However, this check can be bypassed if an attacker makes a minimal deposit. Once bypassed, the attacker can exploit the vulnerability to withdraw excessive funds from the pool, potentially draining it entirely.

Impact

The inadequate validation in the removeLiquidityProportional function allows attackers to bypass checks by making minimal deposits. This enables them to exploit the system and withdraw excessive funds, potentially draining the entire pool and causing significant financial losses to the protocol and its users.

Tools Used

Manual Review

Recommendations

Implement stricter validation in the removeLiquidityProportional function to ensure that withdrawal amounts are directly correlated to the user's actual deposit.