QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

DoS Attack on Innocent Users in `UpliftOnlyExample.sol`

atharv181

Summary

The UpliftOnlyExample.sol contract imposes a limit of 100 deposits per user to prevent out-of-gas errors. However, an attacker can exploit this constraint by transferring a large number of lpNFTs to an innocent user, effectively preventing them from adding new liquidity and making it cost-heacy to remove existing liquidity.

Vulnerability Details

  1. The contract enforces a 100-deposit limit per user using the following check:

if (poolsFeeData[pool][msg.sender].length > 100) {
revert TooManyDeposits(pool, msg.sender);
}

  1. An attacker can deposit minimal liquidity repeatedly, minting lpNFTs for each deposit.

  2. The attacker then transfers these lpNFTs to an innocent user, causing the user's deposit count to exceed the limit.

  3. The innocent user is now unable to:

    • Add more liquidity, as the deposit limit has been reached.

    • Remove liquidity easily, because of high gas costs.

Impact

  1. Breaks constraint of 100 NFT per user

  2. DoS for innocent user to add liquidity and remove liquidity(Loss of Funds)

Tools Used

Manual Review

Recommendations

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_afterUpdate_does_not_check_limit_NFT_per_user

Likelihood: Medium/High, anyone can receive an unlimited NFT number but will cost creation of LP tokens and sending them. Impact: Low/Medium, DoS the afterUpdate and addLiquidityProportional but will be mitigable on-chain because a lot of those NFT can be burn easily in onAfterRemoveLiquidity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!