QuantAMM

Summary

The UpdateWeightRunner contract lacks sufficient safeguards to ensure at least one breakglass mask is set (MASK_POOL_OWNER_UPDATES or MASK_POOL_QUANTAMM_ADMIN_UPDATES). This vulnerability leads to a scenario where pools are entirely locked out from manual overrides if no breakglass permissions are configured during pool initialization. As a result, no authorized party (manager or admin) can intervene in case of emergencies, such as oracle failures or rule malfunctions.

Vulnerability Details

Root Cause

The vulnerability stems from the lack of validation for a "breakglass" mask in the setWeightsManually function. If neither MASK_POOL_OWNER_UPDATES (8) nor MASK_POOL_QUANTAMM_ADMIN_UPDATES (16) is set in the poolRegistry, all manual override attempts fail without an option for recovery, leaving the pool stuck.

The following check is missing in pools without breakglass configurations:

This results in no authorized party being able to manually intervene during emergencies, such as oracle failures or rule misconfigurations. Without these bits, the pool is permanently locked, relying entirely on automated updates which may not function correctly.

Affected Code

• Function setWeightsManually:
  Lacks a validation step to ensure that at least one breakglass bit is active before manual weight setting. This omission allows pools to be deployed or used without any emergency override options.
  UpdateWeightRunner.sol - setWeightsManually

Impact

1. Manual Override Blockage: Pools with poolRegistry = 0 become permanently locked, as no authorized party can perform manual overrides in emergencies.

2. Functional Stagnation: If automated rules fail or oracles return stale data, the pool remains inoperable without any intervention path.

3. Funds Risk: Locked pools prevent users from rebalancing weights or handling liquidity issues, leading to potential financial losses.

Proof of Concept

Test

• Add the following test to pkg/pool-quantamm/test/foundry/UpdateWeightRunner.t.sol:

Test Result

• Result: The test confirms that when poolRegistry = 0 (no breakglass mask set), all attempts to call setWeightsManually(...) fail, regardless of whether the caller is the owner, manager, or a random user. This proves the vulnerability: without a breakglass mask, no manual intervention is possible, leaving the pool permanently locked in emergencies.

Tools Used

• Foundry: to write and run the test suite.

• Manual Code Review: Performed a detailed inspection of the contract's logic to identify the lack of validation for breakglass masks.

Recommendations

1. Enforce Breakglass Masks: Add a require statement in the setWeightsManually(...) function to ensure at least one breakglass mask is active:

   require(

   (poolRegistryEntry & (MASK_POOL_OWNER_UPDATES | MASK_POOL_QUANTAMM_ADMIN_UPDATES)) != 0,

   "No breakglass mask set!"

   );

2. Default Mask Assignment: Automatically assign at least one mask (MASK_POOL_OWNER_UPDATES or MASK_POOL_QUANTAMM_ADMIN_UPDATES) when initializing pools. Emit warnings or revert during initialization if no mask is set.

3. Audit Existing Deployments: Review all pools currently deployed to verify that at least one breakglass mask is active. Update or redeploy pools where this is missing.

Validation Through Testing

• After adding the recommended mitigation to the UpdateWeightRunner contract, include the following test in pkg/pool-quantamm/test/foundry/UpdateWeightRunner.t.sol:

Test Result

By implementing these recommendations, the vulnerability can be fully mitigated, ensuring pools remain operable and protected in emergency situations.