QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

`nftPool[tokenID]` is not reset after `lpNFT.burn(feeDataArray[i].tokenID);` in `UpliftOnlyExample::onAfterRemoveLiquidity`

kazan

Summary

nftPool[tokenID] is not reset after lpNFT.burn(feeDataArray[i].tokenID); in onAfterRemoveLiquidity

Vulnerability Details

After burning lpNFT token, variables related to it (such as nftPool[tokenID]) should also be reset value to avoid confusion. But the onAfterRemoveLiquidity function does not do that. UpliftOnlyExample.sol#L499

Impact

This causes confusion and affects the operations of other parties when performing operations related to nftPool.

PoC

  • Place this test into UpliftExample.t.sol.

  • Then in /2024-12-quantamm/pkg/pool-hooks run forge test --mt test_RemoveLiquidityDoesNotReset_nftPool. It passes.

  • After burn, nftPool[TokenId] = pool.

function test_RemoveLiquidityDoesNotReset_nftPool() public {
// Add liquidity so bob has BPT to remove liquidity.
uint256[] memory maxAmountsIn = [dai.balanceOf(bob), usdc.balanceOf(bob)]
.toMemoryArray();
vm.prank(bob);
upliftOnlyRouter.addLiquidityProportional(
pool,
maxAmountsIn,
bptAmount,
false,
bytes('')
);
vm.stopPrank();
​
uint256 nftTokenId = 1;
assertEq(upliftOnlyRouter.nftPool(nftTokenId), pool, 'pool mapping wrong');
console.log(
'Mapping nftPool[1] before remove liquidity: ',
upliftOnlyRouter.nftPool(nftTokenId)
);
​
// Remove liquidity
uint256[] memory minAmountsOut = [uint256(0), uint256(0)].toMemoryArray();
​
vm.startPrank(bob);
upliftOnlyRouter.removeLiquidityProportional(
bptAmount,
minAmountsOut,
false,
pool
);
vm.stopPrank();
​
// nftPool[tokenID] does not updated
console.log(
'Mapping nftPool[1] after remove liquidity: ',
upliftOnlyRouter.nftPool(nftTokenId)
);
assertEq(upliftOnlyRouter.nftPool(nftTokenId), pool);
}

Tools Used

  • Manual review

  • Foundry

Recommendations

Reset nftPool value atfer burn

lpNFT.burn(feeDataArray[i].tokenID);
+ nftPool[feeDataArray[i].tokenID] = address(0);
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!