QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

quantamm admin can set swap fee to 100%, thereby claiming all the owner fees in UpliftOnlyExample.sol

oluwaseyisekoni

Summary

the quantamm admin has the ability to set swap fee to 100% (1e18), thereby not releasing any ownerfee

Vulnerability Details

UpdateWeightRunner.sol

function setQuantAMMUpliftFeeTake(uint256 _quantAMMUpliftFeeTake) external{
require(msg.sender == quantammAdmin, "ONLYADMIN");
require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");
uint256 oldSwapFee = quantAMMSwapFeeTake;
quantAMMSwapFeeTake = _quantAMMUpliftFeeTake;
​
emit UpliftFeeTakeSet(oldSwapFee, _quantAMMUpliftFeeTake);
}

the line require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");permits the quantammAdmin to set _quantAMMUpliftFeeTaketo 1e18 even though the require statement states otherwise.

UpliftOnlyExample.sol

function setHookSwapFeePercentage(uint64 hookFeePercentage) external onlyOwner {
require(hookFeePercentage >= _MIN_SWAP_FEE_PERCENTAGE, "Below _MIN_SWAP_FEE_PERCENTAGE");
require(hookFeePercentage <= _MAX_SWAP_FEE_PERCENTAGE, "Above _MAX_SWAP_FEE_PERCENTAGE");
​
hookSwapFeePercentage = hookFeePercentage;
​
emit HookSwapFeePercentageChanged(address(this), hookFeePercentage);
}

the function setHookSwapFeePercentageallows the owner in UpliftOnlyExample.sol to set its hookFeePercentage, regardless of the hookFeePercentage set by the owner, the quantammAdmin can claim the all fees in the onAfterSwapin UpliftOnlyExample.solas shown below

function onAfterSwap(
AfterSwapParams calldata params
) public override onlyVault returns (bool success, uint256 hookAdjustedAmountCalculatedRaw) {
...
uint256 quantAMMFeeTake = IUpdateWeightRunner(_updateWeightRunner).getQuantAMMUpliftFeeTake();
uint256 ownerFee = hookFee;
​
if (quantAMMFeeTake > 0) {
@> uint256 adminFee = hookFee / (1e18 / quantAMMFeeTake);
ownerFee = hookFee - adminFee;
address quantAMMAdmin = IUpdateWeightRunner(_updateWeightRunner).getQuantAMMAdmin();
_vault.sendTo(feeToken, quantAMMAdmin, adminFee);
emit SwapHookFeeCharged(quantAMMAdmin, feeToken, adminFee);
}
​
.....
}

if the quantAmmfee is set to 1e18 by the quantAmmfee, the ownerFee is zero

Impact

the owner losses it fees if the quantAmm admin sets the swap fee too 100%

Tools Used

Manual review

Recommendations

the quantAmm admin should be given a fixed swap fee percentage , this way the fee could split appropraitely between the owner and quantAmm admin

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!