QuantAMM

Summary

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L265

the removeliquiditypropotional function is used to remove liquidity from a pool, but there is an issue where by the is missing an important logic, when the lp add liquidity, tokens are being minted to them as shares in the pool, but the shares are not burned when the lp remove their liquidity which can pose a great risk to the pool

the onafterremoveliquidity function handles the burning of the lp share token in the pool and also calculate the fees accured for the lp, the onafterremoveliquidity function is supposed to be called by the removeliquidityproportional when a liquidity provider wants to remove their liquidity so that the function can burn their share in the pool and calculate the fees.

here is the link to the onafterremoveliquidity function

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L431

Impact

the lp can continue to withdraw from the pool until the pool get drained, because the lp shares are not burned when the remove their liquidity

Tools Used

manual

recommendation

ensure lp shares are burned when the are removing their liquidity by calling the onafterremoveliquidity function in the removeliquiditypropotional function