QuantAMM

Summary

The UpdateWeightRunner contract contains a critical denial of service (DoS) vulnerability caused by a division by zero. When updateInterval = 0 is set during the pool registration phase, the _calculateMultiplerAndSetWeights function attempts a division by zero, leading to a panic(0x12): division or modulo by zero. This causes all subsequent weight updates to revert, rendering the pool non-functional. The issue has been detected, reproduced, and confirmed to be present in the current implementation through dedicated testing.

Vulnerability Details

Root Cause

The vulnerability stems from the lack of validation for updateInterval in the setRuleForPool function. When updateInterval = 0, it is subsequently used as a divisor in the _calculateMultiplerAndSetWeights function during weight calculations:

This division by zero triggers a panic(0x12): division or modulo by zero, halting the execution of updates and rendering the pool non-functional. Notably, this can happen due to human error (accidental misconfiguration) or malicious intent, leading to a perpetual freeze of the pool’s update logic.

Affected Code

• Function setRuleForPool:
  Fails to validate that updateInterval > 0, allowing pools to be registered with an invalid value.
  UpdateWeightRunner.sol - setRuleForPool

• Function _calculateMultiplerAndSetWeights:
  Directly uses updateInterval without checking if it is non-zero, resulting in a division by zero error.
  UpdateWeightRunner.sol - _calculateMultiplerAndSetWeights

Impact

Because updateInterval can be configured to 0, the entire weight update process breaks. This disrupts the system’s core functionality and prevents any rebalancing of the pool. Users cannot rely on the pool’s automated weight adjustments, leading to economic and operational impacts.

This issue leads to a critical Denial of Service (DoS) vulnerability:

1. Frozen Pools: Pools with updateInterval = 0 cannot perform updates, locking their weights indefinitely.

2. Operational Disruption: The weight adjustment mechanism, essential for maintaining pool balance, becomes inoperable.

3. Cascading Effects: Multiple frozen pools can disrupt the broader protocol, affecting user trust and liquidity.

4. Reputation Damage: The protocol's credibility is harmed if such misconfigurations occur frequently or are exploited maliciously.

Severity Justification

This vulnerability is classified as critical because any accidental misconfiguration or intentional malicious setup of updateInterval = 0 permanently freezes the affected pool, blocking a core feature of the protocol: dynamic weight rebalancing. This disruption undermines the protocol's utility and creates a systemic risk if multiple pools are impacted simultaneously.

Proof of Concept

Test

• Add the following test to pkg/pool-quantamm/test/foundry/UpdateWeightRunner.t.sol:

Test Result

• Result: The test confirms that updateInterval = 0 causes a division by zero, reverting updates and making the pool non-functional.

Tools Used

• Foundry: Runs the test to demonstrate the division-by-zero scenario.

• Manual Code Review: Verifies that no condition prevents updateInterval = 0 in the core logic prior to mitigation.

Recommendations

1. Direct Check in setRuleForPool(...)

   • Include require(_poolSettings.updateInterval > 0, "updateInterval cannot be 0"); to block the creation of pools with invalid intervals.

2. Additional Guard in _calculateMultiplerAndSetWeights(...)

   • Add require(local.updateInterval != 0, "updateInterval cannot be 0"); to ensure no fallback path can reintroduce the same issue.

3. Documentation

   • Clearly state in deployment scripts and contract docs that updateInterval must be > 0.

4. Testing

   • Maintain a dedicated test (like testCalculateMultiplierWithZeroIntervalMustRevert()) to confirm this edge case remains properly mitigated going forward.

Validation Through Testing

• After adding the recommended mitigations to the UpdateWeightRunner contract, include the following test in pkg/pool-quantamm/test/foundry/UpdateWeightRunner.t.sol:

Test Result

• Result: The test reverted with the expected error: updateInterval cannot be 0.