QuantAMM

Summary

The UpdateWeightRunner::setQuantAMMUpliftFeeTake function includes a check to ensure that the _quantAMMUpliftFeeTake parameter is less than 100%. However, the use of the <= operator in require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%") allows the uplift fee to be set to exactly 100%. This introduces a risk of astronomically high fees, either maliciously or mistakenly, which could erode user trust in the protocol and render the system unusable.

Vulnerability Details

• The setQuantAMMUpliftFeeTake function is designed to allow the administrator (quantammAdmin) to set the uplift fee, represented as a scaled value where 1e18 equates to 100%.

• The check require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%") permits a value of exactly 100%, which could lead to undesirable behaviour such as confiscating all user funds in transactions involving the uplift fee.

Impact

• Protocol Integrity: An uplift fee of 100% effectively confiscates all proceeds in relevant transactions, damaging protocol functionality and usability.

• User Trust: Charging a 100% fee, whether intentionally or accidentally, could severely harm user confidence in the platform.

• Reputation Risk: The protocol risks being perceived as unsafe or mismanaged, potentially leading to reduced adoption and reputational harm.

Tools Used

Manual Review

Recommendations

• Modify the Condition: Change the require statement to use the < operator instead of <=, ensuring that _quantAMMUpliftFeeTake cannot equal 100%.

  - require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");

  + require(_quantAMMUpliftFeeTake < 1e18, "Uplift fee must be less than 100%");

• ** Establish Reasonable Limits:** Introduce a maximum threshold for the uplift fee (e.g., 5% or 0.05e18) to ensure that fees remain user-friendly and within acceptable bounds

  - require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");

  + require(_quantAMMUpliftFeeTake < 0.05e18, "Uplift fee must be less than 5%");

By implementing these recommendations, the protocol will safeguard against unintended or malicious configurations of the uplift fee, ensuring operational safety and preserving user trust.