QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Valid

Protocol lacks adaptability due to immutable fee structure in UpliftOnlyExample

0xtheblackpanther

Summary

The UpliftOnlyExample hardcodes critical fee parameters (minWithdrawalFeeBps & upliftFeeBps) in the constructor without providing setter functions, limiting the protocol's ability to adapt to market conditions or business requirements.

Impact

Protocol cannot adjust fee parameters post-deployment, potentially leading to economic inefficiencies and lost revenue opportunities.

PoC

Add testUpliftFeesAreImmutablein pkg/pool-hooks/test/foundry/UpliftExample.t.sol and run it :)

function testUpliftFeesAreImmutable() public {
// Get initial fees set in constructor from setUp()
uint64 initialMinWithdrawalFee = upliftOnlyRouter.minWithdrawalFeeBps();
uint64 initialUpliftFee = upliftOnlyRouter.upliftFeeBps();
​
// Verify initial fees are correct from setUp()
assertEq(initialMinWithdrawalFee, 5, "Initial minWithdrawalFeeBps should be 5");
assertEq(initialUpliftFee, 200, "Initial upliftFeeBps should be 200");
​
// Try to update the protocol fees
vm.startPrank(owner);
// Both lines below won't compile - no setters exist
// upliftOnlyRouter.setMinWithdrawalFeeBps(300);
// upliftOnlyRouter.setUpliftFeeBps(300);
vm.stopPrank();
​
// Verify fees remain unchanged
assertEq(upliftOnlyRouter.minWithdrawalFeeBps(), 5, "Fee should be immutable");
assertEq(upliftOnlyRouter.upliftFeeBps(), 200, "Fee should be immutable");
}

Recommendation

Add setter functions with appropriate access control and boundary checks:

function setMinWithdrawalFeeBps(uint64 _fee) external onlyOwner {
require(_fee <= MAX_WITHDRAWAL_FEE, "Fee too high");
minWithdrawalFeeBps = _fee;
emit MinWithdrawalFeeBpsUpdated(_fee);
}
​
function setUpliftFeeBps(uint64 _fee) external onlyOwner {
require(_fee <= MAX_UPLIFT_FEE, "Fee too high");
upliftFeeBps = _fee;
emit UpliftFeeBpsUpdated(_fee);
}
Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Appeal created

n0kto Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_upliftFeeBps_is_immutable_but_should_be_changeable_according_to_the_sponsor

Likelihood: Low, it cannot be changed but should not need to be changed often. Impact: Low, the code still works with fees.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.