QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: high
Valid

Truncation due to bad order of division causing higher fees sent to the admin

0xhuntoor

Summary

precision loss in UpliftOnlyExample::onAfterSwap() fee calculation mechanism that leads to very high QuantAdmin fees percentage from hookFee.

Vulnerability Details

The fee calculation in onAfterSwap() performs division operations in a bad order:

if (quantAMMFeeTake > 0) {
uint256 adminFee = hookFee / (1e18 / quantAMMFeeTake);
ownerFee = hookFee - adminFee;

The issue arises from dividing 1e18 by quantAMMFeeTake first, which creates truncation that gets magnified in subsequent calculations.

Examples:

  • For quantAMMFeeTake = 0.3e18 (30%)

  • 1e18 / 0.3e18 = 3.333... truncates to 3

  • With hookFee = 100e18:

    • Calculated: adminFee = 100e18/3 = 33e18

    • Expected: 100e18 * 0.3 = 30e18

    • Difference: +10% overcharge

Another Example That will eat all the swap Fees (Works with any thing above 0.5e18 as quantAMMFeeTake):

  • For quantAMMFeeTake = 0.7e18 (70%)

  • 1e18 / 0.7e18 = 1.428... truncates to 1

  • With hookFee = 100e18:

    • Calculated: adminFee = 100e18/1 = 100e18

    • Expected: 100 * 0.7 = 70e18

    • Difference: +42.8% overcharge

NOTE!: The issues doesn't assume the admin to be behaving maliciously, but its just a valid fee % that is <= 1e18 as checked here

File: UpdateWeightRunner.sol
141: function setQuantAMMUpliftFeeTake(uint256 _quantAMMUpliftFeeTake) external{
142: require(msg.sender == quantammAdmin, "ONLYADMIN");
143: require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");
144: uint256 oldSwapFee = quantAMMSwapFeeTake;
145: quantAMMSwapFeeTake = _quantAMMUpliftFeeTake;
146:
147: emit UpliftFeeTakeSet(oldSwapFee, _quantAMMUpliftFeeTake);
148: }

Impact

Fees overcharged % from hookFee during onAfterSwap() Hook

Tools Used

  • Manual code

Recommendations

Implement the following fix to maintain precision:

uint256 adminFee = (hookFee * quantAMMFeeTake) / 1e18;
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_onAfterSwap_adminFee_overestimated_solidity_rounding_down

Likelyhood: High, quantAMMFeeTake is a percentage on calculated fees. Being between 30-70% is very likely. Impact: High, fees for LP providers will be lower than expected and 0 if the admin fees is above 50%.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.