QuantAMM

Summary

The getPoolLPTokenValue function attempts to scale oracle prices to 18 decimals for culculations .However, the function incorrectly assumes the oracle prices lack decimal precision and blindly multiplies them by 1e18. Since oracle prices are already scaled to 1e18 from the getData functions ,this results in over-scaling. The inflated pool value impacts the calculated LP token valuation causing it to be significantly higher than it should be.

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L668

In getPoolLPTokenValue function this line attempts to scale _prices[i] to 18 decimals

Oracle prices are fetched using the getData function:

These prices typically have been scaled to 1e18 decimals.
as shown by the oracleWrapper and implemented in the oracle getData functions.

The over-scaled price is used in:

balancesLiveScaled18[i] already assumes 18-decimal precision for prices. Using an over-scaled price inflates the pool value (poolValueInUSD) by a factor of
1e18.

The function returns

With an inflated poolValueInUSD and poolTotalSupply in 18 decimals, the final LP token value is highly overestimated .In addition the functions loops through several tokens making the impact of the bug very huge.

Impact

Inflated pool values propagate to other parts of the system leading to incorrect calculations, liquidity mismanagement and Economic exploitation

Tools Used

Manual review.

Recommendations

The prices are already scaled by a factor of 1e18.No need to rescale again.