QuantAMM

Summary

Fees are accrued to the Admin address, however they can never be withdrawn.

Vulnerability Details

During withdrawals and swaps, fees are accrued to the QuantAMMAdmin, however these fees can never be withdrawn.
On the UpLift contract, there is no withdraw method as they cannot be withdrawn using the removeLiquidityProportional() since poolsFeeData[] is never updated for them, and have no LPNFT.
During liquidity removal, _vault.addLiquidity() is called which adds liquidity on behalf of the admin address, however if the admin tries to remove liquidity directly from the contract, the hookcontract of the pool which is the UpliftContract is called. ANd when the onAfterRemoveLiquidity() is called, it will revert for the admin.

Impact

Fees accrued for the protocol can never be withdrawn

Tools Used

NA

Recommended Mitigation

Check is userAddress == QuantAMMAdmin in onAfterRemoveLiquidity(), skip all fee calculation and deductions to enable smooth withdrawals.
Alternatively, run a full deposit for the admin