QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Wrong Fee Take Function Called in UpliftOnlyExample Causing Incorrect Fee Distribution

tinnohofficial

Vulnerability Details

In UpliftOnlyExample.sol, when calculating swap fees in onAfterSwap(), the contract calls getQuantAMMUpliftFeeTake() instead of getQuantAMMSwapFeeTake(). This is incorrect because:

Looking at the UpdateWeightRunner contract, there are two separate fee take percentages:

  • quantAMMSwapFeeTake - For swap fees (accessed via getQuantAMMSwapFeeTake())

  • An uplift fee take intended for withdrawal uplift fees (accessed via getQuantAMMUpliftFeeTake())

The context is clearly for swap fees since this occurs in onAfterSwap(), so it should have used getQuantAMMSwapFeeTake().

function onAfterSwap(AfterSwapParams calldata params) // ...
// ... snip ...
// @audit should be getQuantAMMSwapFeeTake()
@> uint256 quantAMMFeeTake = IUpdateWeightRunner(_updateWeightRunner).getQuantAMMUpliftFeeTake();
uint256 ownerFee = hookFee;
// ...

Impact

The bug causes the wrong fee percentage to be used for swap fee calculations.

Tools used

Manual Review

Recommendations

Fix the function call in UpliftOnlyExample.sol in the onAfterSwap function:

- uint256 quantAMMFeeTake = IUpdateWeightRunner(_updateWeightRunner).getQuantAMMUpliftFeeTake();
+ uint256 quantAMMFeeTake = IUpdateWeightRunner(_updateWeightRunner).getQuantAMMSwapFeeTake();
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_onAfterSwap_collect_upliftFee_instead_of_swap_fees

Likelihood: High, incorrect fees used everytime during swaps. Impact: Low, fees are still collected but not the right amount. But currently both fees are the same due to another bug.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!