QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Wrong checking how many deposit user have in `UpliftOnlyExample::addLiquidityProportional`, one user can deposit 101 times.

kazan

Summary

Wrong checking how many deposit user have in UpliftOnlyExample::addLiquidityProportional, one user can deposit 101 times.

Vulnerability Details

In UpliftOnlyExample, to avoid Ddos issues, a single depositor can only deposit 100 times. And addLiquidityProportional function have a checking to ensure that.UpliftOnlyExample.sol#L226-L228

if (poolsFeeData[pool][msg.sender].length > 100) {
revert TooManyDeposits(pool, msg.sender);
}

This checking code is wrong, it use > in stead of >=. It is not revert if user have 100 deposits. And after this, user still can deposit one more time.

Impact

User can deposit 101 times.

PoC

  • Place this test into UpliftExample.t.sol.

  • Then in /2024-12-quantamm/pkg/pool-hooks run forge test --mt test_userCanDeposit101Times. It passes.

function test_userCanDeposit101Times() public {
uint256[] memory maxAmountsIn = [dai.balanceOf(bob), usdc.balanceOf(bob)]
.toMemoryArray();
​
vm.startPrank(bob);
uint256 bptAmountDeposit = bptAmount / 150;
for (uint256 i = 0; i < 101; i++) {
upliftOnlyRouter.addLiquidityProportional(
pool,
maxAmountsIn,
bptAmountDeposit,
false,
bytes('')
);
skip(1 days);
}
vm.stopPrank();
​
LPNFT lpNft = upliftOnlyRouter.lpNFT();
​
assertEq(lpNft.balanceOf(bob), 101);
}

Tools Used

  • Manual review

  • Foundry

Recommendations

  • Use >= instead of >.

- if (poolsFeeData[pool][msg.sender].length > 100) {
+ if (poolsFeeData[pool][msg.sender].length >= 100) {
revert TooManyDeposits(pool, msg.sender);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_Uplift_101_deposit_strict_equal

Only 1 more NFT won’t have any impact. Informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!