QuantAMM

Summary

When the function UpliftOnlyExample:addLiquidityProportional() is called, an NFT in minted to the sender and then the pool associated with the newly minted NFT is set to the appropriate pool address. Upon removal of liquidity and burning of the NFT, the state variable that stores the associated pool for the burnt NFT is not reset, this leaves the smart contract in an inconsistent state where an NFT no longer exist but it ID is still stored with an associated pool.

Vulnerability Details

This vulnerability occurs on this line where an NFT id is assigned it associated pool but not subsequently reset to an empty address upon burning of the NFT.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L262

Impact

This leads to inconsistent state of the smart contract storage because in reality the an NFT is no longer in existence but smart contract still keeps a refrence of it associated pool stored in it state.

Tools Used

Manual Review

Recommendations

Once liquidity is removed and the NFT is burned, the corresponding pool for an NFT should be reset after burning of the NFT. Here's a code snippet of how to fix that.
nftPool[tokenID] = address(0);