QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

off-by-one error causing deposit limit to be 101 and not 100

huntoor

Summary

The deposit limit check in UpliftOnlyExample::addLiquidityProportional() allows 101 deposits instead of the intended 100 deposit limit due to off-by-one error

Vulnerability Details

The check if (poolsFeeData[pool][msg.sender].length > 100) is performed before pushing the new deposit to the array. This means when a user has exactly 100 deposits, they can still make one more deposit since 100 is not greater than 100, allowing them to reach 101 total deposits.

Its worth mentioning that The test in UpliftExample.t.sol loops from i = 0 to i =101 (in which the length will be 102)

function testAddLiquidityThrowOnLimitDeposits() public {
uint256[] memory maxAmountsIn = [dai.balanceOf(bob), usdc.balanceOf(bob)].toMemoryArray();
vm.startPrank(bob);
uint256 bptAmountDeposit = bptAmount / 150;
for (uint256 i = 0; i < 150; i++) {
if (i == 101) {
vm.expectRevert(abi.encodeWithSelector(UpliftOnlyExample.TooManyDeposits.selector, pool, bob));
upliftOnlyRouter.addLiquidityProportional(pool, maxAmountsIn, bptAmountDeposit, false, bytes(""));
break;
} else {
upliftOnlyRouter.addLiquidityProportional(pool, maxAmountsIn, bptAmountDeposit, false, bytes(""));
}
skip(1 days);
}
vm.stopPrank();

Impact

  • Contradicts the documented design intention of maximum 100 deposits

  • Increases risk of out-of-gas errors during array operations with the extra deposit

Tools Used

Manual Review

Recommendations

Change the condition to use >= instead of >:

if (poolsFeeData[pool][msg.sender].length >= 100) {
revert TooManyDeposits(pool, msg.sender);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_Uplift_101_deposit_strict_equal

Only 1 more NFT won’t have any impact. Informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!