QuantAMM

Vulnerability Details

The UpliftOnlyExample contract manages liquidity positions using an NFT-based system where users can deposit assets and receive an NFT representing their liquidity position. When users withdraw their liquidity, the contract calculates fees based on price changes since deposit time, using a FILO (First In, Last Out) order through a feeData array that tracks all deposits.

During the removeLiquidity operation, the contract processes fees by iterating through the feeData array in reverse order, starting from the most recent deposit. This iteration happens in the following vulnerable code:

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-hooks/contracts/hooks-quantamm/UpliftOnlyExample.sol#L471

The vulnerability occurs because when i reaches 0 and --i executes, it will underflow since this operation is not protected by Solidity's underflow checks in the loop condition. This causes the transaction to revert due to Solidity 0.8.x's arithmetic safety checks.

This means that users who need to perform through the last item of the array to remove their liquidity will suffer a permanent DoS as the transaction will revert whenever they try to remove liquidity.

Impact

• DOS - Users cannot remove their liquidity whenever the array reaches position 0 to deduct the amount left.

Tools Used

Manual Review & Foundry

Recommendations

Decrement the iinside the loop.