Some fees are sent to the incorrect address
Summary
UpliftOnlyExample::onAfterSwap is responsible for calculating fees during swaps by deducting a portion of the tokens received from the vault and sending the remainder to the user.
The portion allocated to fees is divided into quantAMMFeeTake and ownerFee, but ownerFee can lead to issues.
Vulnerability Details
This specific fee is sent as a token to the router's address, which is problematic because there is no function to extract those tokens from the contract, leaving them permanently trapped.
Impact
Loss of value intended for the owner.
It's worth noting that replacing the address designated for the owner could cause issues in some variants. If the contract ownership is renounced, sending tokens to the zero address could result in reverts.
Tools Used
Manual Review
Recommendations
Store a specific address in the contract's storage to receive the router fees.
Lead Judging Commences
finding_ownerFee_cannot_be_withdrawn
Likelihood: High, every swap. Impact: High, funds are stuck.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.