QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Valid

Protocol lacks adaptability due to immutable fee structure in UpliftOnlyExample

0xtheblackpanther

Summary

The UpliftOnlyExample hardcodes critical fee parameters (minWithdrawalFeeBps & upliftFeeBps) in the constructor without providing setter functions, limiting the protocol's ability to adapt to market conditions or business requirements.

Impact

Protocol cannot adjust fee parameters post-deployment, potentially leading to economic inefficiencies and lost revenue opportunities.

PoC

Add testUpliftFeesAreImmutablein pkg/pool-hooks/test/foundry/UpliftExample.t.sol and run it :)

function testUpliftFeesAreImmutable() public {
// Get initial fees set in constructor from setUp()
uint64 initialMinWithdrawalFee = upliftOnlyRouter.minWithdrawalFeeBps();
uint64 initialUpliftFee = upliftOnlyRouter.upliftFeeBps();
​
// Verify initial fees are correct from setUp()
assertEq(initialMinWithdrawalFee, 5, "Initial minWithdrawalFeeBps should be 5");
assertEq(initialUpliftFee, 200, "Initial upliftFeeBps should be 200");
​
// Try to update the protocol fees
vm.startPrank(owner);
// Both lines below won't compile - no setters exist
// upliftOnlyRouter.setMinWithdrawalFeeBps(300);
// upliftOnlyRouter.setUpliftFeeBps(300);
vm.stopPrank();
​
// Verify fees remain unchanged
assertEq(upliftOnlyRouter.minWithdrawalFeeBps(), 5, "Fee should be immutable");
assertEq(upliftOnlyRouter.upliftFeeBps(), 200, "Fee should be immutable");
}

Recommendation

Add setter functions with appropriate access control and boundary checks:

function setMinWithdrawalFeeBps(uint64 _fee) external onlyOwner {
require(_fee <= MAX_WITHDRAWAL_FEE, "Fee too high");
minWithdrawalFeeBps = _fee;
emit MinWithdrawalFeeBpsUpdated(_fee);
}
​
function setUpliftFeeBps(uint64 _fee) external onlyOwner {
require(_fee <= MAX_UPLIFT_FEE, "Fee too high");
upliftFeeBps = _fee;
emit UpliftFeeBpsUpdated(_fee);
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Appeal created

n0kto Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_upliftFeeBps_is_immutable_but_should_be_changeable_according_to_the_sponsor

Likelihood: Low, it cannot be changed but should not need to be changed often. Impact: Low, the code still works with fees.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!