QuantAMM

Summary

In onAfterRemoveLiquidity function, there is a potential for arithmetic underflow in the loop iterating over the feeDataArray when processing liquidity removal. This issue arises from the use of a decrementing loop that does not properly handle the underflow condition for a uint256 variable. This can lead to unintended behavior, including infinite loops and out-of-bounds access.

Vulnerability Details

In the onAfterRemoveLiquidity the issue is found in the line of code below

• The loop initializes i to localData.feeDataArrayLength - 1, which is the last valid index of the feeDataArray.

• When i reaches 0, the next decrement (--i) causes i to underflow, wrapping around to 2^256 - 1.

• This results in an infinite loop, as the condition i >= 0 will always evaluate to true for unsigned integers.

Impact

The contract may become unresponsive, consuming gas indefinitely, which can lead to denial of service for users attempting to interact with the contract.

Tools Used

Manual Review

Recommendations

Modify the loop to start from localData.feeDataArrayLength and check that i is greater than 0 to prevent underflow.