QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

setWeights Allows Bypassing `absoluteWeightGuardRail` During Updates

mbushbush

setWeights Allows Bypassing absoluteWeightGuardRail During Updates

Code Snippets

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L653

Summary

The setWeights function in the QuantAMM contract lacks validation to ensure weights remain above the absoluteWeightGuardRail during updates, enabling invalid weights that can destabilize the pool and expose the protocol to exploits.

Vulnerability Details

While _setInitialWeights enforces a check to prevent weights below absoluteWeightGuardRail during initialization, the setWeights function has no such validation. This omission allows administrators to set weights below the threshold during updates initiated by the UpdateWeightRunner contract.

Relevant Code: _setInitialWeights enforces the minimum weight:

for (uint i; i < _weights.length; ) {
--> if (_weights[i] < int256(uint256(absoluteWeightGuardRail))) {
revert MinWeight();
}

However, setWeights is missing similar validation. This allows weights below the threshold to be set during updates, bypassing protections enforced during initialization.

Impact

Invalid weights disrupt pool balance, impairing functionality and exposing the protocol to economic risks.

Tools Used

Manual Review

Recommendations

Add a check in setWeights to validate all weights against absoluteWeightGuardRail.

Updates

Lead Judging Commences

n0kto Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

invalid_weights_can_be_negative_or_extreme_values

_clampWeights will check that these weights are positive and in the boundaries before writing them in storage.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.