QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

repeated new array in function QuantAMMStorage.sol#_quantAMMUnpack128Matrix()

zhanmingjing

Summary

repeated new array in function QuantAMMStorage.sol#_quantAMMUnpack128Matrix()

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMStorage.sol#L465

https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/QuantAMMStorage.sol#L497

function _quantAMMUnpack128Matrix(
int256[] memory _sourceArray,
uint _numberOfAssets
) internal pure returns (int256[][] memory targetArray) {
// | 1 2 | 3 4 | 5 6 | 7 8 | 9 _ |
​
// becomes 2d array of 3 elements each with 3 elements
​
// | |1|, |2|, |3|, |
// | |4|, |5|, |6|, |
// | |7|, |8|, |9| |
require(_sourceArray.length * 2 >= _numberOfAssets * _numberOfAssets, "Source cannot provide target");
targetArray = new int256[][]();
for (uint i; i < _numberOfAssets; ) {
targetArray[i] = new int256[]();
unchecked {
++i;
}
}
​
uint targetIndex;
uint targetRow;
for (uint i; i < _sourceArray.length; ) {
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i] >> 128));
unchecked {
++targetIndex;
}
​
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i]));
unchecked {
++targetIndex;
}
} else {
unchecked {
++targetRow;
targetIndex = 0;
}
if (targetRow < _numberOfAssets) {
targetArray[targetRow] = new int256[]();
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i]));
unchecked {
++targetIndex;
}
}
}
}
} else {
unchecked {
++targetRow;
targetIndex = 0;
}
if (targetRow < _numberOfAssets) {
targetArray[targetRow] = new int256[]();
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i] >> 128));
unchecked {
++targetIndex;
}
​
if (targetIndex < _numberOfAssets) {
targetArray[targetRow][targetIndex] = int256(int128(_sourceArray[i]));
unchecked {
++targetIndex;
}
} else {
unchecked {
++targetRow;
targetIndex = 0;
}
if (targetRow < _numberOfAssets) {
targetArray[targetRow] = new int256[]();
}
}
}
}
​
unchecked {
++i;
}
}
​
if ((_numberOfAssets * _numberOfAssets) % 2 != 0) {
targetArray[_numberOfAssets - 1][_numberOfAssets - 1] = int256(
int128(_sourceArray[_sourceArray.length - 1])
);
}
}

new array of targetArray[][] is done at the quite beginning of function _quantAMMUnpack128Matrix(). Then during the process of unpack, if unpack to a new targetrow, new array again.

Impact

repeated renew

Tools Used

manually reviewed

Recommendations

delete Line465 and Line497

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.