QuantAMM

Summary

The afterUpdate function in the UpliftOnlyExample contract allows unlimited position transfers to a target address, enabling a DOS attack that can prevent users from removing liquidity or transferring their legitimate positions.

Vulnerability Details

In the UpliftOnlyExample contract, the afterUpdate function is responsible for handling position transfers between addresses. When a position is transferred, it adds the position's fee data to the recipient's array:

The vulnerability lies in the fact that there is no limit on how many positions can be transferred to a single address. An attacker can exploit this by:

1. Waiting for a user to create a legitimate position

2. Creating multiple small (dust) positions

3. Transferring all these dust positions to the target user's address

When the victim tries to remove liquidity or transfer their legitimate position, the contract must iterate through all positions to process the request. With enough dust positions, this operation will consume more gas than the block limit allows, causing the transaction to revert.

Impact

DOS - Users can be permanently prevented from removing liquidity or transferring their positions, effectively locking their funds in the protocol. This attack is relatively inexpensive to execute since it only requires creating multiple small positions.

Tools Used

Manual Review

Recommendations

Implement a maximum limit on the number of positions that can be held by a single address:

This change ensures that no address can accumulate enough positions to cause gas-related DOS attacks while still allowing legitimate users to manage a reasonable number of positions.