QuantAMM

Summary

in onAfterRemoveLiquidity() fees of the withdrawn tokens amounts (whatever its upLift or the minimum fees) of the last user withdrawing from the pool will be donated to empty pool.

Vulnerability Details

NOTE!: the bug about accruedQuantAMMFees wrong distribution since Admin don't have position registered in poolsFeeData Is assumed to be solved by sending actual tokens to the admin

in onAfterRemoveLiquidity() The code calculate fees on the withdrawn tokens amounts (whatever its upLift or the minimum fees) and donates part of it to the pool and part of it to the QuantAMM admin, Here:

But the problem is that There are alot of circumstances where user withdrawing is the last withdrawer of the pool, what happens is:

1. User will get charged fees, part of it added to the admin (in the correct way) and part of it is donated to the pool

2. this will create an empty pool that have tokens in it with no corresponding BPT

3. MEV can immediately add liquidity (to mint BPT) and remove liquidity (burning the BPT and getting the initially deposited tokens Plus the stuck tokens)

4. The problem is yet that on MEV interactions, they will be charged fees and donated to the again empty pool (after MEV removing liquidity)

5. This will create some tokens in the end that is never retrievable and always stuck in the pool

The above scenario describes what happens when the first mentioned bug get fixed by sending fees to the admin as actual tokens

Now if they decide to solve it by registering admin fee position in poolsFeeData then

1. Last withdrawer gets charged fees that part of it mint liquidity to admin, and part of it gets donated to the pool (that now have the admin liquidity, meaning that the admin owns all token Pools)

2. Admin comes to remove liquidity and he himself will be charged fee that again that of it mint liquidity to admin, and part of it gets donated to the pool

3. Again and again and again (yet pool will have stuck funds either way after last withdrawer)

Impact

Stuck funds in the pool

Tools Used

Manual Review

Recommendations

if the withdrawer is the last withdrawer (vault supply is 0) send all fees to the admin, or don't charge fees (like any pool does with the last withdrawer, they simply transfer all the balance of the pool to him)