QuantAMM

Summary

The UpliftOnlyExample contract allows users to reset their uplift fees to a lower rate by transferring LP tokens to another wallet when fees are decreased, resulting in potential loss of yield for fee recipients.

Vulnerability Details

In the afterUpdate function of the UpliftOnlyExample contract, when an LP token is transferred between addresses, the contract updates the upliftFeeBps for the token to the current global fee rate:

This creates an exploit path where users can avoid paying higher historical fees by:

1. Waiting for the admin to lower the global upliftFeeBps fee rate

2. Transferring their LP tokens to another wallet they control

3. Having their fee rate reset to the new lower rate, avoiding the previous higher rate

Impact

Loss of yield - Fee recipients (like liquidity providers) lose expected yield when users exploit this fee reset mechanism to avoid paying their original higher fee rates.

Tools Used

Manual Review

Recommendations

Remove the fee rate update during token transfers to maintain the original fee rate associated with the deposit:

This ensures that the original fee rate stays with the LP position regardless of transfers between addresses, preventing fee avoidance through transfers.