QuantAMM

Summary

In removeLiquidityProportional when users want to remove liquidity, the contract needs to transfer the reward from the vault to the user

removeLiquidityHook

While the token needs to be sent ex: USDC If the vault is blacklisted by the token, the sendTo the function call will revert, causing the removeLiquidityHook to fail.

This will prevent users from removing their liquidity from the pool

Impact

The impact is rated as LOW because users' funds would become locked in the protocol. However, this scenario requires specific conditions that are unlikely to occur:

• The token must implement a blacklist

• user tries to remove liquidity

• vault is blacklisted

Tools Used

Manual review

Recommendations

Consider implementing a fallback mechanism when reward transfers fail using a try-catch block. Though the likelihood of this attack occurring is extremely low this code block should be wrapped in a try/catch, as removing liquidity should never revert under any circumstances as this would cause user who added liquidity to lose their LPs thus losing funds.