QuantAMM

Summary

The UpliftOnlyExample contract allows users to bypass uplift fees by transferring LP NFTs between their own wallets, as the position value is reset without charging profit fees during transfers.

Vulnerability Details

In the afterUpdate function of UpliftOnlyExample.sol, when an LP token is transferred between addresses, the contract updates the deposit value to the current value without applying any uplift fees:

The vulnerability exists because:

1. The transfer resets the position's deposit value to the current value

2. No profit fees are charged during the transfer

3. Users can maintain their actual position value while avoiding fees by transferring between their own wallets

This creates a significant economic exploit where users can:

1. Accumulate profits in their position

2. Transfer the LP token to another wallet they control

3. Reset their profit tracking without paying any fees

4. Remove liquidity without paying any fees

Impact

Loss of yield - The protocol and liquidity providers lose fee revenue as users can systematically avoid paying uplift fees on their profits through transfers.

Tools Used

Manual Review

Recommendations

Consider not updating the deposit value during transfers. This would allow profit to persist and but the obligation to pay fees on the recipient. As long as it is documented that the recipient will be charged fees on whatever profit the position has this would be a valid solution.