QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Valid

UpliftOnlyExample uses block.number instead of block.timestmap

holydevoti0n

Vulnerability Details

To track fee data for deposits, the following struct is used:

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L75

/// @notice The fee data for a given owner and deposit
struct FeeData {
uint256 tokenID;
uint256 amount;
uint256 lpTokenDepositValue;
uint40 blockTimestampDeposit; // notice the timestamp field
uint64 upliftFeeBps;
}

Notice that when user add liquidity, this field is properly set:

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L250-L260

poolsFeeData[pool][msg.sender].push(
FeeData({
tokenID: tokenID,
amount: exactBptAmountOut,
//this rounding favours the LP
lpTokenDepositValue: depositValue,
//known use of timestamp, caveats are known.
blockTimestampDeposit: uint40(block.timestamp),
upliftFeeBps: upliftFeeBps
})
);

The problem is when user transfers the token to another address, the blockTimestampDepositis incorrectly set with block.number, completely losing track of the actual timestamp

if (tokenIdIndexFound) {
if (_to != address(0)) {
// Update the deposit value to the current value of the pool in base currency (e.g. USD) and the block index to the current block number
//vault.transferLPTokens(_from, _to, feeDataArray[i].amount);
feeDataArray[tokenIdIndex].lpTokenDepositValue = lpTokenDepositValueNow;
@> feeDataArray[tokenIdIndex].blockTimestampDeposit = uint32(block.number);
feeDataArray[tokenIdIndex].upliftFeeBps = upliftFeeBps;
...

Usually, timestamp can be used to determine fees/rewards for users, but as seen above the protocol lost it.

Notice this is not the same known issue about "timestamps"(related to L2s).

Impact

  • Contract has no tracking of actual deposit timestamps

Tools Used

Manual Review

Recommendations

Replace block.number with block.timestamp.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_afterUpdate_blockNumber_instead_of_timestamp

Likelihood: Medium/High, any NFT transfer will change this variable. Impact: Informational/Very Low. This variable is unused and won’t impact anything, but the array is public and its getter will return a variable with inconsistencies.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!