QuantAMM

Summary

The _addLiquidityProportional function does not provide an option to revoke remaining token approvals after deposits. Since the function calculates exact BPT out but not exact tokens in, users who want to limit their token approvals cannot do so effectively, potentially leaving excess approvals that could be exploited if the pool is compromised.

Vulnerability Details

The issue arises because:

1. Users specify exact BPT out but cannot specify exact tokens in

2. The actual amount of tokens required is calculated by the pool

3. Users must approve more tokens than may be needed

4. Without user intervention excess approvals remain active indefinitely

This is particularly problematic for users who intentionally set specific approval amounts as a security measure, rather than providing unlimited approvals.

Impact

Loss of funds

If the pool contract is compromised, an attacker could exploit the remaining token approvals to drain additional funds from users who intended to only approve the exact amount needed for their deposit.

Tools Used

Manual Review

Recommendations

Add an optional parameter to revoke remaining approvals:

This allows:

• Users who want unlimited approvals can set revokeRemainingApproval = false

• Users who want exact approvals can set revokeRemainingApproval = true

• Maintains flexibility while improving security for users who want stricter approval controls