QuantAMM

Summary

The UpdateWeightRunner contract incorrectly uses the same storage variable quantAMMSwapFeeTake for both swap fees and uplift fees, leading to incorrect fee calculations in the UpliftOnlyExample contract.

Vulnerability Details

In UpdateWeightRunner:

• Both setQuantAMMUpliftFeeTake() and setQuantAMMSwapFeeTake() modify the same storage variable quantAMMSwapFeeTake

• getQuantAMMUpliftFeeTake() returns quantAMMSwapFeeTake

In UpliftOnlyExample:

• Line 331: Retrieves uplift fee using getQuantAMMUpliftFeeTake()

• Line 519: Uses the same function for swap fee calculations

This means both uplift fees and swap fees will always be identical, which is likely not the intended behavior, (evidenced from the two setter and getter functions too)

Impact

• Incorrect fee calculations as uplift fees and swap fees cannot be set independently

Tools Used

Manual Review

Recommendations

1- Add separate storage variable for uplift fees:

2- Update getter functions to return correct variables:

3- Ensure setter functions modify their respective variables