QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

`nftPool` mapping is not cleared after removing liquidity

0xshoonya

Vulnerability Details

In the UpliftOnlyExample.sol contract, the nftPool mapping is used to associate NFT token IDs with pool addresses. This mapping is populated when liquidity is added:

function addLiquidityProportional(
address pool,
uint256[] memory maxAmountsIn,
uint256 exactBptAmountOut,
bool wethIsEth,
bytes memory userData
) external payable saveSender(msg.sender) returns (uint256[] memory amountsIn) {
​
...snip...
​
uint256 tokenID = lpNFT.mint(msg.sender);
​
...snip...
​
nftPool[tokenID] = pool;

However, when liquidity is removed and the NFT is burned, this mapping entry is never cleared. While this doesn't pose a functional security risk since token IDs are strictly increasing and can never be reused (as implemented in LPNFT.sol's mint function), it does lead to unnecessary state bloat in the contract.

Recommendations

Add cleanup logic in the remove liquidity function to clear the mapping entry when an NFT is burned

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.