QuantAMM

Summary

In the UpdateWeightRunner contract, there is a function called setQuantAMMUpliftFeeTake, which is supposed to set the quantAMMUpliftFeeTake. However, due to a critical oversight, this function is instead modifying quantAMMSwapFeeTake, resulting in a severe disruption of the protocol's swap and uplift fee mechanisms. To make matters worse, the state variable quantAMMUpliftFeeTake doesn’t even exist in the protocol, compounding the problem.

This oversight affects both the setter and getter functions, rendering the uplift fee mechanism completely dysfunctional.

Vulnerability Details

Code Analysis

UpdateWeightRunner::setQuantAMMUpliftFeeTake

UpdateWeightRunner::getQuantAMMUpliftFeeTake

Observations

1. Setter Function Issue:

   • The setQuantAMMUpliftFeeTake function updates quantAMMSwapFeeTake instead of quantAMMUpliftFeeTake.

   • There is no state variable quantAMMUpliftFeeTake, which makes it impossible to store uplift fee values.

2. Getter Function Issue:

   • The getQuantAMMUpliftFeeTake function incorrectly returns quantAMMSwapFeeTake instead of the intended uplift fee value.

Proof of Concept (PoC)

Steps to Reproduce:

1. Admin sets quantAMMSwapFeeTake to >80%.

2. Admin intends to set quantAMMUpliftFeeTake to <30%.

3. Admin calls the setQuantAMMUpliftFeeTake function.

4. The function executes incorrectly, setting quantAMMSwapFeeTake to <30% while leaving the intended quantAMMUpliftFeeTake unset.

5. A separate function calls getQuantAMMUpliftFeeTake.

6. Instead of returning the intended uplift fee, it returns quantAMMSwapFeeTake.

Result:

• Swap fee (quantAMMSwapFeeTake) is misconfigured to <30%.

• Uplift fee (quantAMMUpliftFeeTake) cannot be set, as the variable doesn’t exist.

• Both swap and uplift fees are disrupted, leading to incorrect protocol behavior.

Your test suit already has a test for this.

Impact

1. Disruption of Protocol Fee Mechanisms:

   • Swap fee and uplift fee values are misconfigured, distorting the protocol's fee mechanisms.

2. Inaccurate Fee Charging:

   • Users could be charged incorrect fees for swaps and uplifts, undermining trust in the protocol.

3. Medium Severity:

   • Although the fees remain within the acceptable range (<1e18), the misconfiguration disrupts the intended functionality.

Tools Used

Manual Review

Recommendations

Code Fix

UpdateWeightRunner Contract

Add the missing state variable quantAMMUpliftFeeTake:

Updated setQuantAMMUpliftFeeTake

Updated getQuantAMMUpliftFeeTake

Benefits

• Ensures the uplift fee is correctly configured and stored.

• Restores the intended functionality of both swap and uplift fee mechanisms.

• Avoids incorrect fee calculations, maintaining user trust in the protocol.

Identical fees and stricly less than 1e18 < 1e18, both issues are addressed and acknowledged in a different finding. I'm a bit less confident about that finding because of admin-input-validation but i think that's also worth to be a valid one.