QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

The `setQuantAMMSwapFeeTake` and `setQuantAMMUpliftFeeTake` functions both update the same state variable `quantAMMSwapFeeTake`, which is likely a mistake.

biakia

Summary

The functions setQuantAMMSwapFeeTake and setQuantAMMUpliftFeeTake both modify the same state variable quantAMMSwapFeeTake. This creates a logical flaw in the contract as both functions are intended to set different fee values but end up overwriting the same variable.

Vulnerability Details

In contract UpdateWeightRunner, the setQuantAMMSwapFeeTake and setQuantAMMUpliftFeeTake functions both update the same state variable quantAMMSwapFeeTake, which is likely a mistake:

function setQuantAMMSwapFeeTake(uint256 _quantAMMSwapFeeTake) external override {
require(msg.sender == quantammAdmin, "ONLYADMIN");
require(_quantAMMSwapFeeTake <= 1e18, "Swap fee must be less than 100%");
uint256 oldSwapFee = quantAMMSwapFeeTake;
quantAMMSwapFeeTake = _quantAMMSwapFeeTake;
​
emit SwapFeeTakeSet(oldSwapFee, _quantAMMSwapFeeTake);
}
function setQuantAMMUpliftFeeTake(uint256 _quantAMMUpliftFeeTake) external{
require(msg.sender == quantammAdmin, "ONLYADMIN");
require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");
uint256 oldSwapFee = quantAMMSwapFeeTake;
quantAMMSwapFeeTake = _quantAMMUpliftFeeTake;
​
emit UpliftFeeTakeSet(oldSwapFee, _quantAMMUpliftFeeTake);
}

These two functions are intended to manage different fees (swap fees and uplift fees), so they should update separate state variables.

This leads to ambiguity and potential losses, as one fee setting can inadvertently affect the other. If a user or other contract calls one function to set the fee, the settings from the other function will be ignored, leading to situations where either the swap fee or uplift fee might not behave as intended. The business logic that requires separate fee settings is thus compromised.

Impact

The Impact is MEDIUM, the Likelihood is MEDIUM, so the Severity is MEDIUM.

Tools Used

Manual Review

Recommendations

Consider adding a new state variable for the uplift fee:

uint256 public quantAMMUpliftFeeTake;

Update setQuantAMMUpliftFeeTake:
Modify the setQuantAMMUpliftFeeTake function to update the new quantAMMUpliftFeeTake variable instead of quantAMMSwapFeeTake:

function setQuantAMMUpliftFeeTake(uint256 _quantAMMUpliftFeeTake) external {
require(msg.sender == quantammAdmin, "ONLYADMIN");
require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");
uint256 oldUpliftFee = quantAMMUpliftFeeTake;
quantAMMUpliftFeeTake = _quantAMMUpliftFeeTake;
​
emit UpliftFeeTakeSet(oldUpliftFee, _quantAMMUpliftFeeTake);
}

Update getQuantAMMUpliftFeeTake:

Modify the getQuantAMMUpliftFeeTake function to return the new quantAMMUpliftFeeTake variable:

function getQuantAMMUpliftFeeTake() external view returns (uint256) {
return quantAMMUpliftFeeTake;
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_quantAMMSwapFeeTake==quantAMMUplfitFeeTake

Likelyhood: High, calling setters or getters Impact: Low/Medium, both getters return `quantAMMSwapFeeTake` and `setQuantAMMUpliftFeeTake` modify `quantAMMUplfitFeeTake`. Real impact: those 2 values will be always the same.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!