QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: high
Valid

Loss of Fees for Router `UpliftOnlyExample` due to Division Rounding in Admin Fee Calculation, Causing Unfair Fee Distribution

0xpep7

Summary

The audit identified a vulnerability in the UpliftOnlyExample contract where a division rounding in the admin fee calculation lead to significant precision loss, resulting in unfair fee distribution.

Vulnerability Details

  • Found in pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol at Line 335

293: function onAfterSwap(
...
334: if (quantAMMFeeTake > 0) {
335: => uint256 adminFee = hookFee / (1e18 / quantAMMFeeTake);
336: ownerFee = hookFee - adminFee;
...
349: }

The root cause of the vulnerability is that the equation adminFee = hookFee / (1e18 / quantAMMFeeTake) takes advantage of the precision loss of integer division, where the denominator 1e18 / quantAMMFeeTake rounds down significantly before the next division of hookFee, making the adminFee larger than expected.

Let's observe the following comparison table to see the impact of the rounding error:

quantAMMFeeTake adminFee expectedAdminFee ownerFee expectedOwnerFee router loss
0.1e18 (10%) 0.1 * hookFee 0.1 * hookFee 0.9 * hookFee 0.9 * hookFee 0
0.2e18 (20%) 0.2 * hookFee 0.2 * hookFee 0.8 * hookFee 0.8 * hookFee 0
0.3e18 (30%) 0.333 * hookFee 0.3 * hookFee 0.667 * hookFee 0.7 * hookFee 0.033 * hookFee
0.4e18 (40%) 0.5 * hookFee 0.4 * hookFee 0.5 * hookFee 0.6 * hookFee 0.1 * hookFee
0.5e18 (50%) 0.5 * hookFee 0.5 * hookFee 0.5 * hookFee 0.5 * hookFee 0
0.5001e18 (50.01%) 1 * hookFee 0.5001 * hookFee 0 0.4999 * hookFee 0.4999 * hookFee
0.6e18 (60%) 1 * hookFee 0.6 * hookFee 0 0.4 * hookFee 0.4 * hookFee
0.7e18 (70%) 1 * hookFee 0.7 * hookFee 0 0.3 * hookFee 0.3 * hookFee
0.8e18 (80%) 1 * hookFee 0.8 * hookFee 0 0.2 * hookFee 0.2 * hookFee
0.9e18 (90%) 1 * hookFee 0.9 * hookFee 0 0.1 * hookFee 0.1 * hookFee
1.0e18 (100%) 1 * hookFee 1.0 * hookFee 0 0 0

Key Notes:

  1. adminFee values are calculated using hookFee / (1e18 / quantAMMFeeTake) and normalized where applicable.

  2. expectedAdminFee is calculated using hookFee * quantAMMFeeTake / 1e18.

  3. ownerFee is hookFee - adminFee.

  4. expectedOwnerFee is hookFee - expectedAdminFee.

This clearly demonstrates how the incorrect formula causes inflated adminFee and diminished ownerFee, especially as quantAMMFeeTake starts to exceed 0.5e18 (50%).

Impact

The inability to accurately calculate the admin fee not only breaks the core functionality of the protocol's fee distribution, but also causes a significant loss for the router in terms of accrued fee incomes.

Tools Used

Manual Review

Recommendations

Consider using the normal practice of multiplying before division, such as

uint256 adminFee = hookFee * quantAMMFeeTake / 1e18;

to minimize precision loss and ensure fair fee distribution.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_onAfterSwap_adminFee_overestimated_solidity_rounding_down

Likelyhood: High, quantAMMFeeTake is a percentage on calculated fees. Being between 30-70% is very likely. Impact: High, fees for LP providers will be lower than expected and 0 if the admin fees is above 50%.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!