QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Precision loss will occur in the onAfterRemoveLiquidity function based on certain inputs within the uplift only example contract

gbadebosmith

Summary

The formula relies on integer division, which truncates any fractional result. In cases where the numerator is not evenly divisible by the denominator (10000), precision loss will occur. This loss of precision can lead to underpayment or overpayment of calculated fees (feePerLP), particularly when handling small values or edge cases.

Vulnerability Details

The vulnerable code is here:

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L431-L570

// Line 482
(uint256(localData.lpTokenDepositValueChange) * (uint256(feeDataArray[i].upliftFeeBps) * 1e18)) /
10000;
// Line 489
feePerLP = (uint256(minWithdrawalFeeBps) * 1e18) / 10000;

An example:

For localData.lpTokenDepositValueChange = 12345 and upliftFeeBps = 7, the calculation:

feePerLP = (12345 * (7 * 1e18)) / 10000;

yields:

  • Numerator: 12345 * 7 * 1e18 = 8.6415e22

  • Result (integer division): 8.6415e18

Impact

The truncation of fractional parts leads to a minor but potentially exploitable discrepancy.

Tools Used

Manual code review.

Recommendations

Reorder operations to multiply before dividing to preserve precision for as long as possible.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!