QuantAMM

Summary

The QuantAMM protocol's gradient-based update rules share a common state mapping that persists across rule transitions, allowing potential manipulation of pool weights through inconsistent gradient interpretations between different rules.

Vulnerability Details

The QuantAMM protocol implements several weight update rules that inherit from QuantammGradientBasedRule to dynamically adjust pool weights. These rules include MomentumUpdateRule, AntiMomentumUpdateRule, ChannelFollowingUpdateRule, and PowerChannelUpdateRule.

The base contract QuantammGradientBasedRule maintains gradient states in a shared mapping:

QuantammGradientBasedRule.sol#L18-L19

This mapping stores intermediate gradient calculations used by all rules for exponential moving averages and weight adjustments. The critical vulnerability stems from three key issues:

1. The intermediateGradientStates mapping is shared across all rules for a given pool address

2. The mapping is marked as internal rather than private, allowing inherited contracts to modify it

3. The setRuleForPool() function in UpdateWeightRunner lacks gradient state validation during rule transitions

Different rules interpret these gradients in fundamentally different ways:

When a pool transitions between rules via setRuleForPool(), the gradient states persist without normalization, allowing the new rule to misinterpret the previous rule's gradient calculations.

Impact

Medium severity as the shared gradient state can be exploited to manipulate pool weights during rule transitions, leading to artificial price movements and arbitrage opportunities. While weight guards provide some protection, the core issue allows gradual manipulation across update cycles.

Proof of Concept

1. Attacker initializes pool with MomentumUpdateRule:

1. Manipulates gradient state through price movements:

1. Transitions to ChannelFollowingUpdateRule:

1. Exploits distorted weights through arbitrage before normalization.

Tools Used

Manual Review

Recommended Mitigation Steps

Implement gradient state isolation by extending the state mapping with rule type and add gradient normalization during rule transitions. Additionally, implement proper validation in the UpdateWeightRunner to ensure safe state transitions between different update rules, preventing potential manipulation of pool weights through gradient state inheritance.