QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: medium
Valid

Shared Storage Variable for Swap Fees and Uplift Fees

0xvd

Summary

The quantAMMSwapFeeTake storage variable is used for both swap fees and uplift fees due to a bug in the setQuantAMMUpliftFeeTake function.

This means the two logically distinct fee parameters share the same storage, leading to potential overwriting, miscalculations, or protocol misbehavior.

Vulnerability Details

The setQuantAMMUpliftFeeTake function overwrites the quantAMMSwapFeeTake variable instead of using a separate variable for the uplift fee:

function setQuantAMMUpliftFeeTake(uint256 _quantAMMUpliftFeeTake) external {
require(msg.sender == quantammAdmin, "ONLYADMIN");
require(_quantAMMUpliftFeeTake <= 1e18, "Uplift fee must be less than 100%");
uint256 oldSwapFee = quantAMMSwapFeeTake; // Incorrectly uses quantAMMSwapFeeTake
quantAMMSwapFeeTake = _quantAMMUpliftFeeTake; // Overwrites swap fee variable
​
emit UpliftFeeTakeSet(oldSwapFee, _quantAMMUpliftFeeTake);
}

The intended functionality is to allow the admin to independently set the swap fee (quantAMMSwapFeeTake) and the uplift fee (quantAMMUpliftFeeTake).

However, both functions operate on the same variable (quantAMMSwapFeeTake), causing them to overwrite each other.

Additionally, the getQuantAMMUpliftFeeTake function incorrectly retrieves the quantAMMSwapFeeTake value:

function getQuantAMMUpliftFeeTake() external view returns (uint256) {
return quantAMMSwapFeeTake; // Returns the swap fee instead of uplift fee
}

Impact

Changes to the uplift fee inadvertently overwrite the swap fee and vice versa, leading to incorrect fee amounts being applied in protocol operations.

Recommendations

Implement separate storage variables for each fee type

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_quantAMMSwapFeeTake==quantAMMUplfitFeeTake

Likelyhood: High, calling setters or getters Impact: Low/Medium, both getters return `quantAMMSwapFeeTake` and `setQuantAMMUpliftFeeTake` modify `quantAMMUplfitFeeTake`. Real impact: those 2 values will be always the same.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.