QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Off-by-One Error in Deposit Limit Check Creates Documentation Mismatch

cheatc0d33

Description

The addLiquidityProportional function in the UpliftOnlyExample contract contains a deposit limit check that doesn't match its documented behavior:

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L219

// Current implementation
if (poolsFeeData[pool][msg.sender].length > 100) {
revert TooManyDeposits(pool, msg.sender);
}
​
// Documentation states
/**
* @notice To avoid Ddos issues, a single depositor can only deposit 100 times
*/

The implementation allows 101 deposits while the documentation specifies a limit of 100 deposits.

Impact

This issue represents a minor discrepancy between documented and implemented deposit limits in the QuantAMM protocol. The additional allowance of a 101st deposit beyond the documented limit of 100 has negligible impact on gas costs, array management, and protocol security, with BTF positions being designed for long-term holding and the FILO withdrawal pattern naturally encouraging position consolidation. While this inconsistency does not affect core protocol functionality such as TFMM calculations or fee assessments, it still warrants fixing to maintain precise documentation-to-implementation alignment, ensure consistent developer experience, and prevent potential confusion in protocol integration or auditing processes.

Recommended Mitigation Steps

  1. Update the implementation to match documentation:

if (poolsFeeData[pool][msg.sender].length >= 100) {
revert TooManyDeposits(pool, msg.sender);
}

  1. Alternative: Update documentation to reflect implementation:

/**
* @notice To avoid Ddos issues, a single depositor can only deposit up to 101 times
* @param pool The pool the depositor is attempting to deposit to
* @param depositor The address of the depositor
*/
error TooManyDeposits(address pool, address depositor);

Choose based on whether exact limit of 100 is a business requirement or an approximate guideline.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_Uplift_101_deposit_strict_equal

Only 1 more NFT won’t have any impact. Informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.