QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

NFT not burnt when removing Liquidity

ifexx445

Summary

In the removeLiquidityProportional function of the upliftOnlyExample.sol contract, the LP (Liquidity Provider) token associated with the removed liquidity is not being burnt. Typically, when a user withdraws liquidity from a pool, their corresponding LP tokens are burnt to ensure that these tokens no longer represent ownership of the pool's liquidity. The absence of this burn mechanism can result in an accumulation of unburnt LP tokens, even though the associated liquidity has been withdrawn.

Vulnerability Details

Below we can see that lp tokens are being minted in the add liquidity function:

function addLiquidityProportional(
address pool,
uint256[] memory maxAmountsIn,
uint256 exactBptAmountOut,
bool wethIsEth,
bytes memory userData
) external payable saveSender(msg.sender) returns (uint256[] memory amountsIn) {
if (poolsFeeData[pool][msg.sender].length > 100) {
revert TooManyDeposits(pool, msg.sender);
}
// Do addLiquidity operation - BPT is minted to this contract.
amountsIn = _addLiquidityProportional(
pool,
msg.sender,
address(this),
maxAmountsIn,
exactBptAmountOut,
wethIsEth,
userData
);
​
@> uint256 tokenID = lpNFT.mint(msg.sender);

But when removing liquidty tokens are not being burnt :

​
function removeLiquidityProportional(
uint256 bptAmountIn,
uint256[] memory minAmountsOut,
bool wethIsEth,
address pool
) external payable saveSender(msg.sender) returns (uint256[] memory amountsOut) {
uint depositLength = poolsFeeData[pool][msg.sender].length;
​
if (depositLength == 0) {
revert WithdrawalByNonOwner(msg.sender, pool, bptAmountIn);
}
// Do removeLiquidity operation - tokens sent to msg.sender.
amountsOut = _removeLiquidityProportional(
pool,
address(this),
msg.sender,
bptAmountIn,
minAmountsOut,
wethIsEth,
abi.encodePacked(msg.sender)
);
}

Impact

Users may retain their LP tokens after withdrawing liquidity, which could allow them to re-use these tokens for unauthorized interactions, such as claiming rewards or voting in governance systems tied to LP token holdings.

Tools Used

Manual audit

Recommendations

Add the burn mechanism for removed LP tokens

Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!