QuantAMM

Summary

Swaps will revert for tokens that revert on zero-token transfers, when the amount being swapped is small.

Vulnerability Details

In the onAfterSwapfunction:

For the sake of example let's say that the hookFee is 1 (possible when the amount being swapped is small), the quantAMMFeeTakehas a default value of 0.5e18 (as seen in UpdateWeightRunner).

Then, adminFee = hookFee / (1e18 / quantAMMFeeTake);
=> adminFee = 1 / (1e18 / 0.5e18)
=> adminFee = 0 (round-down in Solidity)

So, when _vault.sendTo(feeToken, quantAMMAdmin, adminFee);is called, the vault tries to transfer 0 tokens.

This will revert for ERC20 tokens like LEND, which revert on zero token transfers.

The issue can become more severe if the quantAMMFeeTakeis a very small value. As the setter in updateWeightRunner only has an upper bound on quantAMMFeeTake, quantAMMFeeTakecan indeed be a very small value. This would imply that adminFeewill be 0, even for bigger values of hookFee. So, even bigger swaps, which generate bigger values ofhookFeecan also revert.

Impact

Swaps will revert when adminFee=0, for tokens that revert on zero-transfers.

Tools Used

Manual review

Recommendations

Add the following: