QuantAMM

Summary

In the addLiquidityProportional function, the contract does not effectively limit the maximum number of deposits per user. Although the function attempts to check the number of deposits with if (poolsFeeData[pool][msg.sender].length > 100), the condition is incorrectly implemented. It should be >= 100 instead of > 100. As a result, users are still allowed to deposit even after making 100 deposits, leading to potential unintended behavior, including denial-of-service (DDoS) attacks.

Vulnerability Details

The contract contains a logic error in the check used to limit the number of deposits for each user. Specifically, the condition poolsFeeData[pool][msg.sender].length > 100 should be changed to >= 100 to properly enforce the limit. The current implementation allows deposits beyond the 100 deposit threshold, which is not the desired behavior. This issue may result in:

1. Deposit Limit Not Being Enforced: Users may be able to deposit more than 100 times, violating the intended deposit restriction.

2. Inconsistent Behavior: The deposit limit logic is not working as expected, leading to inconsistent contract behavior, making the contract difficult to maintain and predict.

Impact

This vulnerability could lead to the following problems:

1. Inconsistent Contract Behavior: Due to the incorrect deposit limit check, the contract will not behave as intended, causing difficulty in predicting its actions.

2. Resource Exhaustion: The system could be abused by a single user making excessive deposits, potentially causing resource exhaustion, such as high gas costs or affecting the platform’s stability.

3. Denial-of-Service (DDoS) Risk: The incorrect logic could be exploited by malicious users, leading to a flood of transactions and causing denial-of-service attacks, degrading the service for other users.

Tools Used

Manual code audit

Recommendations

It is recommended to fix the deposit check logic by changing the condition to >= 100. This ensures that the contract enforces the deposit limit correctly. Below is the corrected code:

By making this change, the contract will correctly enforce the deposit limit and prevent users from exceeding the allowed number of deposits.