QuantAMM

Summary

Reentrancy Vulnerability in removeLiquidityProportional

Vulnerability Details

The removeLiquidityProportional function calls _removeLiquidityProportional without a nonReentrant guard. While saveSender is used, this isn't sufficient protection against a reentrancy attack within _removeLiquidityProportional, particularly if _removeLiquidityProportional involves external calls or further state updates. The function's fee calculation within a loop also compounds the risk. The potential for an attacker to manipulate internal state (fee conditions) before funds are transferred presents a significant risk.

Exploitation Path: A malicious contract can call removeLiquidityProportional, then call back into UpliftOnlyExample (directly, or indirectly through _removeLiquidityProportional) before the funds are transferred, potentially stealing the intended withdrawal amount.

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol

Tools Used

vscode

Recommendations

Enforce a nonReentrant modifier within the removeLiquidityProportional function itself. Further, ensure all relevant internal operations (including those made in _removeLiquidityProportional ) are protected against re-entry, with comprehensive checks of all external function calls.