QuantAMM

Summary

The performUpdate function does not update lastPoolUpdateRunwhich is unintended.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L279C5-L300C6

Vulnerability Details

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L279C5-L300C6

The performUpdate function retrieves the PoolRuleSettings for the pool and stores it in a memory variable settings

PoolRuleSettings memory settings = poolRuleSettings[_pool];

It then checks if enough time has passed since the last update

require(block.timestamp - settings.timingSettings.lastPoolUpdateRun >= settings.timingSettings.updateInterval,````"Update not allowed"````);

The function proceeds to call _performUpdateAndGetData, passing settings as an argument

_performUpdateAndGetData(_pool, settings);

However, after performing the update, the code does not update the lastPoolUpdateRun timestamp in the storage variable poolRuleSettings[_pool]

After each successful update, the lastPoolUpdateRun should be set to the current block.timestamp. This ensures that subsequent updates adhere to the updateInterval constraint.

Since the lastPoolUpdateRun is not updated in storage, repeated calls to performUpdate will always find the condition in the require statement to be true (as lastPoolUpdateRun remains at its initial value, likely 0 after deployment)

Impact

The function is intended to enforce a minimum time interval (updateInterval) between updates to prevent excessive or rapid updates but that will not be achieved.

Tools Used

Manual Review

Recommendations

After performing the update, you need to update the lastPoolUpdateRun in the storage variable to reflect the current time.