QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: high
Valid

Owner fees stuck in the `UpliftOnlyExample`

draiakoo

Summary

Owner fees collected during swaps will be stuck in the contract because there is no permissioned withdraw function

Vulnerability Details

All swaps that happen in Quant pools execute the onAfterSwap hook from the UpliftOnlyExample. This hook does the following:

function onAfterSwap(
AfterSwapParams calldata params
) public override onlyVault returns (bool success, uint256 hookAdjustedAmountCalculatedRaw) {
hookAdjustedAmountCalculatedRaw = params.amountCalculatedRaw;
...
​
uint256 quantAMMFeeTake = IUpdateWeightRunner(_updateWeightRunner).getQuantAMMUpliftFeeTake();
uint256 ownerFee = hookFee;
​
if (quantAMMFeeTake > 0) {
uint256 adminFee = hookFee / (1e18 / quantAMMFeeTake);
ownerFee = hookFee - adminFee;
address quantAMMAdmin = IUpdateWeightRunner(_updateWeightRunner).getQuantAMMAdmin();
_vault.sendTo(feeToken, quantAMMAdmin, adminFee);
emit SwapHookFeeCharged(quantAMMAdmin, feeToken, adminFee);
}
​
if (ownerFee > 0) {
_vault.sendTo(feeToken, address(this), ownerFee);
​
emit SwapHookFeeCharged(address(this), feeToken, ownerFee);
}
}
...
}

It computes a percentage amount as fee that will be substracted from the user swap. This fee amount is divided between the admin fee and the owner fee. The admin fee is sent to the quant admin address which is a timelock contract according to the docs. Hence, this contract will be able to manage the funds sent. However, the owner fee is sent to the UpliftOnlyExample contract. However there is no permissioned function that allow the owner to withdraw the collected fees. The end result will be that the owner fees will remain stuck in this contract forever because it is not upgradeable

Impact

High, lose of funds

Tools Used

Manual review

Recommendations

Add a function that allow the owner to withdraw any token from the router

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_ownerFee_cannot_be_withdrawn

Likelihood: High, every swap. Impact: High, funds are stuck.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.