QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Fee State Variable Modification in UpdateWeightRunner Breaks Uplift Model

12121212

Description
The setQuantAMMUpliftFeeTake function in UpdateWeightRunner incorrectly modifies quantAMMSwapFeeTake instead of maintaining a separate state variable for uplift fees. This causes the protocol's uplift-based fee model to malfunction since getQuantAMMUpliftFeeTake() returns swap fee values.

And also the getter function getQuantAMMUpliftFeeTake returns quantAMMSwapFeeTake which shouldnt be.

function setQuantAMMUpliftFeeTake(uint256 _quantAMMUpliftFeeTake) external {
require(msg.sender == quantammAdmin, "ONLYADMIN");
require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");
uint256 oldSwapFee = quantAMMSwapFeeTake;
quantAMMSwapFeeTake = _quantAMMUpliftFeeTake; // @audit wrong state variable
emit UpliftFeeTakeSet(oldSwapFee, _quantAMMUpliftFeeTake);
}

Impact

  • Incorrect fee distribution between protocol and LPs

  • Setting up quantAMMUpliftFeeTake overwrites quantAMMSwapFeeTake. So if the system chooses to use two distinctive value for these variables, it wouldn't be achievable.

Proof of Concept

  1. Admin sets uplift fee to 20% using setQuantAMMUpliftFeeTake(0.2e18)

  2. This overwrites quantAMMSwapFeeTake

  3. When UpliftOnlyExample calls getQuantAMMUpliftFeeTake(), it receives swap fee value

  4. Fee calculations in withdrawal use incorrect percentage

  5. Both swap and uplift fee mechanisms are corrupted

Recommended Mitigation

  1. Add separate state variable:

contract UpdateWeightRunner {
uint256 public quantAMMSwapFeeTake;
uint256 public quantAMMUpliftFeeTake;
​
function setQuantAMMUpliftFeeTake(uint256 _quantAMMUpliftFeeTake) external {
require(msg.sender == quantammAdmin, "ONLYADMIN");
require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");
uint256 oldUpliftFee = quantAMMUpliftFeeTake;
quantAMMUpliftFeeTake = _quantAMMUpliftFeeTake;
emit UpliftFeeTakeSet(oldUpliftFee, _quantAMMUpliftFeeTake);
}
}

  1. Modify the Getter function to this:

function getQuantAMMUpliftFeeTake() external view returns (uint256){
- return quantAMMSwapFeeTake;
+ return quantAMMUpliftFeeTake;
}
Updates

Lead Judging Commences

n0kto Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_quantAMMSwapFeeTake==quantAMMUplfitFeeTake

Likelyhood: High, calling setters or getters Impact: Low/Medium, both getters return `quantAMMSwapFeeTake` and `setQuantAMMUpliftFeeTake` modify `quantAMMUplfitFeeTake`. Real impact: those 2 values will be always the same.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!