QuantAMM

Summary

Currently the fee calculation in the swap hook is vulnerable to precision loss and can lead to incorrect admin and owner fees being distributed.

Vulnerability Details

The fee calculation in onAfterSwap will be impacted by a precision loss at the following operation: adminFee = hookFee / (1e18 / quantAMMFeeTake).

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L335

The precision loss will be dependent on the value of quantAMMFeeTake. Since it can be updated by a setter function and it accepts any value below 1e18, the precision loss can happen in practice. Although it can be fixed by setting a new value, once the precision loss happen it's irreversible on the affected swaps.

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L141-L148

Please note this precision loss issue was not reported by the bot report.

Numerical POC:

If we multiply the numerator and denominator by 1e18 we would receive a more accurate result:

With the precision loss the adminFee would be 200e18 and the ownerFee would be 400e18.

Without the precision loss, the adminFee would be 180e18 and the ownerFee would be 420e18.

Therefore, in this example we can see a 20e18 in difference for the adminFee and ownerFee.

Impact

The consequence would be miscalculations of the fees received by the quant AMM and the pool.

As these calculations will be executed via the hook on every swap, the inaccuracies can accumulate over time.

The bigger the raw token amount calculated by the swap entered via the hook, the bigger the difference will be.

Tools Used

Manual review.

Recommendations

Multiply the numerator and the denominator by 1e18 to avoid the precision loss while calculating the adminFee: