QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

quantAMMSwapFeeTake used for both getQuantAMMSwapFeeTake and getQuantAMMUpliftFeeTake.

0xwsecteam

Summary

The quantAMMSwapFeeTake variable is used for both swap fee and uplift fee.
This creates ambiguity in the contract's logic and exposes the system to potential misconfiguration or misuse, both setQuantAMMSwapFeeTake and setQuantAMMUpliftFeeTake
methods modify the same state variable quantAMMSwapFeeTake, and both getQuantAMMSwapFeeTake and getQuantAMMUpliftFeeTake returns its value.

Vulnerability Details

Both swap fee QuantAMMSwapFeeTake and uplift fee QuantAMMUpliftFeeTake share the same state variable, quantAMMSwapFeeTake.
Modifying one fee setting overwrites the value for the other, causing potential fee loss if Admin decided to update swap fee the uplift fee
will also updated.

POC: add test in UpdateWeightRunner.t.sol

function testChange_SwapFee_and_UpliftFee(uint256 fee) public {
uint256 boundFee = bound(fee, 0, 1e18);
​
vm.startPrank(owner);
updateWeightRunner.setQuantAMMSwapFeeTake(boundFee);
vm.stopPrank();
​
assertEq(updateWeightRunner.getQuantAMMSwapFeeTake(), boundFee);
assertEq(updateWeightRunner.getQuantAMMUpliftFeeTake(), boundFee);
}

Result:

Ran 1 test for test/foundry/UpdateWeightRunner.t.sol:UpdateWeightRunnerTest
[PASS] testChange_SwapFee_and_UpliftFee(uint256) (runs: 10000, μ: 23552, ~: 23301)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 492.87ms (491.41ms CPU time)

Impact

If fees are misconfigured, the protocol might either overcharge or undercharge users, leading to a loss of fee revenue for Admin.

Recommendations

uint256 public quantAMMSwapFeeTake = 0.5e18;
+ uint256 public quantAMMUpliftFeeTake = 0.5e18;
​
function setQuantAMMUpliftFeeTake(uint256 _quantAMMUpliftFeeTake) external{
require(msg.sender == quantammAdmin, "ONLYADMIN");
require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");
- uint256 oldSwapFee = quantAMMSwapFeeTake;
- quantAMMSwapFeeTake = _quantAMMUpliftFeeTake;
+ uint256 oldSwapFee = quantAMMUpliftFeeTake;
+ quantAMMUpliftFeeTake = _quantAMMUpliftFeeTake;
emit UpliftFeeTakeSet(oldSwapFee, _quantAMMUpliftFeeTake);
}
​
// @notice Get the quantAMM uplift fee % amount allocated to the protocol for running costs
function getQuantAMMUpliftFeeTake() external view returns (uint256){
- return quantAMMSwapFeeTake;
+ return quantAMMUpliftFeeTake;
}
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_quantAMMSwapFeeTake==quantAMMUplfitFeeTake

Likelyhood: High, calling setters or getters Impact: Low/Medium, both getters return `quantAMMSwapFeeTake` and `setQuantAMMUpliftFeeTake` modify `quantAMMUplfitFeeTake`. Real impact: those 2 values will be always the same.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.