QuantAMM

Summary

Note!: This bug assumes that upliftFeeBps is applied in the upLifted value only as intended in the whitePaper and assumes the rounding down to 0 of lpTokenDepositValueChange is solved

The UpliftOnlyExample contract's uplift fee calculation can result in fees lower than the intended minimum when small uplifts occur, potentially enabling MEV attacks that were meant to be prevented by minWithdrawalFeeBps.

Vulnerability Details

Current implementation uses an if/else block that chooses between fees types during liquidity removal:

When calculating fees for uplifted positions:

Example scenario:

1. minWithdrawalFeeBps = 0.5% (50 bps)

2. upliftFeeBps = 50% (5000 bps)

3. MEV deposits 100e18

4. Gets 1% uplift (1e18)

5. Fee calculation: 1e18 * 50% = 5e17 (0.05% of total deposit)

6. Actual fee (0.05%) < minWithdrawalFeeBps (0.5%)

This creates a gap where MEV can extract value while paying less than the intended minimum fee.

Impact

The vulnerability enables:

1. MEV attacks with fees below intended minimum (for example, just in time liquidity for large swaps and feeless swaps attacks, etc)

2. Potential value extraction through rapid deposit/withdraw cycles attacks

Tools Used

Manual review

Recommendations

add the minWithdrawalFeeBps to the upliftFeeBps