QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect limit checks on setting swap fee could lead to users loss all their funds in `UpdateWeightRunner::setQuantAMMSwapFeeTake` function

pianist

Summary

In the QuantAMMWeightedPool contract, two variables are defined: _MIN_SWAP_FEE_PERCENTAGE and _MAX_SWAP_FEE_PERCENTAGE. These variables are intended to control the limits of the fee percentage for swaps, but they are never actually used.
In contrast, the UpdateWeightRunner contract includes a function called setQuantAMMSwapFeeTake that allows the admin to modify the quantAMMSwapFeeTake variable without using limitaions.

Vulnerability Details

First, the quantAMMSwapFeeTake variable is set to 0.5e18, which represents a 50% fee (above the _MAX_SWAP_FEE_PERCENTAGE limit). Second, in the setQuantAMMSwapFeeTake function, the admin can adjust the swap fee, with the only restriction being that it must be less than 100%, rather than being limited to a range between 0.001% and 10%.

@> uint256 public quantAMMSwapFeeTake = 0.5e18; // @audit it should be between 10% and 0.001%?
​
function setQuantAMMSwapFeeTake(uint256 _quantAMMSwapFeeTake) external override {
require(msg.sender == quantammAdmin, "ONLYADMIN");
@> require(_quantAMMSwapFeeTake <= 1e18, "Swap fee must be less than 100%"); // @audit it should be between 10% and 0.001%?
uint256 oldSwapFee = quantAMMSwapFeeTake;
quantAMMSwapFeeTake = _quantAMMSwapFeeTake;
emit SwapFeeTakeSet(oldSwapFee, _quantAMMSwapFeeTake);
}

Impact

  • Users can loss excessive funds in a case of setting swap fee more than 10% (uppder limit).

  • Protocol may miss-behave mathimatically in a case of setting swap fee equale to zero (less than 0.001% lower limit).

Tools Used

Manual review

Recommendations

Change the code to sth like this:

- uint256 public quantAMMSwapFeeTake = 0.5e18;
+ uint256 public quantAMMSwapFeeTake = 5e16; // initilize to 5%
function setQuantAMMSwapFeeTake(uint256 _quantAMMSwapFeeTake) external override {
require(msg.sender == quantammAdmin, "ONLYADMIN");
- require(_quantAMMSwapFeeTake <= 1e18, "Swap fee must be less than 100%");
+ require(_quantAMMSwapFeeTake <= 10e16, "Swap fee must be less than 10%");
+ require(_quantAMMSwapFeeTake >= 0.001e16, "Swap fee must be more than 0.001%");
uint256 oldSwapFee = quantAMMSwapFeeTake;
quantAMMSwapFeeTake = _quantAMMSwapFeeTake;
emit SwapFeeTakeSet(oldSwapFee, _quantAMMSwapFeeTake);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.