Summary

There is a fee per swap implemented in UpliftOnlyExample.sol which is split between the quantAMM admin and the "owner". The quantAMM fee is correctly sent to the admin's account, but the "owner" fee is sent to the contract itself. There is no withdraw mechanism or way to reapply those funds to the pool, so the tokens are effectively burned.

Vulnerability Details

The onAfterSwap function calculates a hookFee for the swap:

Source: UpliftOnlyExample.sol#L298

Then it splits that fee between the owner and quantAMM admin:

Source: UpliftOnlyExample.sol#L335-L336

However the owner's fee is sent to the contract instead of the owner directly:

Source: UpliftOnlyExample.sol#L343

Unlike the quantAMM fee which is sent to the admin's account as expected:

Source: UpliftOnlyExample.sol#L338

Reviewing the UpliftOnlyExample contract and its dependency shows there is no way to transfer (nor approve) these tokens.

Impact

Tokens such as USDC are locked in UpliftOnlyExample.

POC

The following updates an existing test related to the swap fees to show that USDC is indeed sent to the UpliftOnlyExample contract itself:

Original test source: UpliftExample.t.sol#L958-L1010

Tools Used

After confirming fees are sent to the contract and not the owner account, I then manually reviewed the contract for any way to access those funds. forge flatten helped to pull everything together in one file so I did not overlook any dependencies. I found no way to transfer or approve those funds.

Recommendation

Either send the fees to the owner directly (like the quantAMM admin fees are), or introduce a onlyOwner withdraw function.

If these funds are intended for the owner as defined by the OZ Ownable dependency, then you may want to consider how to handle a renounced owner as well. e.g. instead of burning funds you could send the money to the quantAMM admin, reduce the swap fee, or override the renounce capability to require 0 owner fee configuration first.