Ammplify — H-8: Uninitialized Uniswap ticks inflate `getInsideFees` (funds stuck)

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 63174-h-8-incorrect-inside-fees-calculation-for-uninitialized-unis. Standalone Foundry PoC and full write-up: 63174-h-8-incorrect-inside-fees-calculation-for-uninitialized-unis_exp in the evm-hack-registry mirror.

Vulnerability classes: fee-calculation · locked-funds · data/uninitialized

Reproduction: self-contained Foundry PoC with only forge-std. Full trace: output.txt.

AuditVault taxonomy: severity/high · sector/dex · platform/sherlock · fee-calculation · locked-funds · data/uninitialized

Key info#


Impact	HIGH — position permanently stuck (underflow); also enables fee inflation theft
Protocol	Ammplify
Vulnerable code	`PoolLib.getInsideFees` treats uninitialized tick outsides as 0 → inside = global
Finding	#63174 / issue 422 · panprog
Status	Fixed PR #32
Compiler	`^0.8.24`

TL;DR#

Open maker while ticks uninitialized and price inside range.
Snapshot stores feeGrowthInside = feeGrowthGlobal (inflated).
Settle initializes ticks; later getInsideFees returns ~0.
compound does new - stored → underflow; funds stuck forever.

The vulnerable code#

SOLIDITY

feeGrowthInside0X128 = feeGrowthGlobal0X128 - lowerFeeGrowthOutside0X128 - upperFeeGrowthOutside0X128;
// @> VULN: uninitialized outside=0 → inside = global
// FIX: if tick not initialized, return 0

Diagrams#

flowchart TD A["Open on uninit ticks"] --> B["Snapshot inside = feeGrowthGlobal"] B --> C["Mint initializes ticks"] C --> D["Later getInsideFees ~ 0"] D --> E["0 - global underflows"] E --> F["Position permanently stuck"]

Sources#

AuditVault #63174
Sherlock #422
Source: src/Pool.sol getInsideFees (fix PR #32)

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 63174-h-8-incorrect-inside-fees-calculation-for-uninitialized-unis_exp (evm-hack-registry mirror).
AuditVault finding: 63174-h-8-incorrect-inside-fees-calculation-for-uninitialized-unis.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync