QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

repeated new array in function QuantAMMStorage.sol#_quantAMMUnpack128Matrix()

zhanmingjing

Summary

repeated new array in function QuantAMMStorage.sol#_quantAMMUnpack128Matrix()

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMStorage.sol#L465

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMStorage.sol#L497

function _quantAMMUnpack128Matrix(
int256[] memory _sourceArray,
uint _numberOfAssets
) internal pure returns (int256[][] memory targetArray) {
// | 1 2 | 3 4 | 5 6 | 7 8 | 9 _ |
​
// becomes 2d array of 3 elements each with 3 elements
​
// | |1|, |2|, |3|, |
// | |4|, |5|, |6|, |
// | |7|, |8|, |9| |
require(_sourceArray.length * 2 >= _numberOfAssets * _numberOfAssets, "Source cannot provide target");
targetArray = new int256[][]();
for (uint i; i < _numberOfAssets; ) {
targetArray[i] = new int256[]();
unchecked {
++i;
}
}
​
uint targetIndex;
uint targetRow;
for (uint i; i < _sourceArray.length; ) {
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i] >> 128));
unchecked {
++targetIndex;
}
​
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i]));
unchecked {
++targetIndex;
}
} else {
unchecked {
++targetRow;
targetIndex = 0;
}
if (targetRow < _numberOfAssets) {
targetArray[targetRow] = new int256[]();
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i]));
unchecked {
++targetIndex;
}
}
}
}
} else {
unchecked {
++targetRow;
targetIndex = 0;
}
if (targetRow < _numberOfAssets) {
targetArray[targetRow] = new int256[]();
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i] >> 128));
unchecked {
++targetIndex;
}
​
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i]));
unchecked {
++targetIndex;
}
} else {
unchecked {
++targetRow;
targetIndex = 0;
}
if (targetRow < _numberOfAssets) {
targetArray[targetRow] = new int256[]();
}
}
}
}
​
unchecked {
++i;
}
}
​
if ((_numberOfAssets * _numberOfAssets) % 2 != 0) {
targetArray[_numberOfAssets - 1][_numberOfAssets - 1] = int256(
int128(_sourceArray[_sourceArray.length - 1])
);
}
}

new array of targetArray[][] is done at the quite beginning of function _quantAMMUnpack128Matrix(). Then during the process of unpack, if unpack to a new targetrow, new array again.

Impact

repeated renew

Tools Used

manually reviewed

Recommendations

delete Line465 and Line497

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.