QuantAMM

Summary

The ability to add liquidity with zero-value amounts allows attackers to spam storage with invalid transactions. This behavior could lead to the numMinted variable in the LPNFT contract reaching type(uint256).max, causing an overflow reversion when incrementing numMinted. This attack effectively renders the addLiquidityProportional function which is the entrypoint in the UpliftOnlyExample contract.

Vulnerability Details

• The addLiquidityProportional function allows deposits of zero amounts without validating them.

• Attackers can repeatedly call the function with zero-value deposits, which unnecessarily mints LPNFT tokens for each call.

• The numMinted variable in the LPNFT contract is incremented for each minted token, regardless of the deposit value.

• Once numMinted reaches type(uint256).max, any further attempt to mint a token causes a reversion due to overflow in the following line:
  
  https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/LPNFT.sol#L39

Impact

Permanent DoS: The addLiquidityProportional function of UpliftOnlyExample contract becomes permanently unusable for everybody once numMinted overflows, as no further tokens can be minted.

Tools Used

Manual auditing

Recommendations

1. Reject Zero-Value Deposits: Prevent deposits of 0 by adding a check in the addLiquidityProportional function: