QuantAMM

Summary

The UpliftOnlyExample.sol contract is vulnerable to an exploit that allows a malicious user to drain the entire protocol by removing more liquidity than they provided. This is due to improper validation in the removeLiquidityProportional() function, allowing attackers to pass more bptAmountIn and bypass balance checks.

Vulnerability Details

1. Liquidity Addition:

   • When users add liquidity using addLiquidityProportional(), BPT tokens are minted to the protocol contract address instead of the user's address.

   • Users only receive lpNFT as a representation of their liquidity.

2. Liquidity Removal:

   • In removeLiquidityProportional(), the function accepts bptAmountIn and minAmountsOut parameters.

   • The Balancer vaults calculates amountsOut and calls the onAfterRemoveLiquidity() hook for custom logic.

3. Exploit:

   • The onAfterRemoveLiquidity() function iterates through the user's lpNFT fee data and burns or adjusts their liquidity without validating whether the user has sufficient BPT.

   • An attacker can provide a single small liquidity deposit to bypass the initial ownership check:

     uint depositLength = poolsFeeData[pool][msg.sender].length;

     ​

     if (depositLength == 0) {

     revert WithdrawalByNonOwner(msg.sender, pool, bptAmountIn);

     }

   • They can then call removeLiquidityProportional() with an inflated bptAmountIn, causing the protocol to burn more BPT than they own.

   • onAfterRemoveLiquidity() hook loops through all the deposits of the user and burns the lpNFT but does not check this user burned equal amount of LpNFT which is equal to the value of bptAmountIn.

   • For loop loops over all the data and then takes only upLift fee for that one deposit in our case.

   • As a result, the excess BPT required for the operation is effectively taken from the protocol’s reserves.

   • Attacker gets more fund than they have/provided.

Impact

1. Complete Protocol Drain

Tools Used

Manual Review

Recommendations

1. Checks user has enough BPT amount to burn.

2. After burning all the tokens check user burned enough tokens