QuantAMM

Summary

The MinimalRouter contract's proportional liquidity addition mechanism is vulnerable to a griefing attack where malicious users can manipulate pool ratios through strategic swaps to prevent other users from depositing liquidity.

Vulnerability Details

In the MinimalRouter contract, when users add liquidity using AddLiquidityKind.PROPORTIONAL, the required input amounts are calculated based on the current pool ratios. A malicious actor can exploit this by:

1. Monitoring pending deposit transactions

2. Front-running these deposits by performing strategic swaps that alter the pool ratios

3. Causing the required input amounts to exceed the victim's maxAmountsIn parameters

This attack is particularly profitable for existing LPs since preventing new liquidity providers from joining the pool increases their share of trading fees.

Impact

DOS - The attack can effectively prevent new liquidity providers from joining the pool by making their deposits revert due to exceeding maxAmountsIn limits.

Tools Used

Manual Review

Recommendations

Use a time-weighted average of pool ratios instead of spot ratios when determining the required input amounts. This will mitigate the attack by making it more difficult to manipulate the pool ratios through strategic swaps.