QuantAMM

Summary

The access control mechanism in UpdateWeightRunner::calculateMultiplierAndSetWeightsFromRule() is insufficient as it relies on a pool's self-registered rule address for authorization, which can be manipulated by any pool.

Vulnerability Details

There are two key issues:

1. The function checks msg.sender == address(rules[params.poolAddress]) for authorization, but any pool can call setRuleForPool() to register an arbitrary address as its rule. This means a malicious pool could:

   • Register a malicious contract as its rule

   • Use that contract to call calculateMultiplierAndSetWeightsFromRule()

   • Bypass the intended access control

2. The function checks poolRegistry() directly from the pool contract instead of using the centralized approvedPoolActions mapping. This allows pools to potentially manipulate their own registry flags.

The relevant code:

Impact

Manipulation of pool weights leading to:

• Manipulate token ratios

• Create arbitrage opportunities

• Potentially drain pool funds through price manipulation

Tools Used

• Manual review

Recommendations

1. Add rule address validation in setRuleForPool():

1. Use the centralized approvedPoolActions mapping instead of calling poolRegistry():