QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Running the update for the provided rule can be DoSed

gbadebosmith

Summary

Running the update for the provided rule can be DoSed due to the perform update function not having an access modifier or a sufficient require statement.

Vulnerability Details

On lines 279 to 300 the performUpdate function does not have enough security restriction to prevent any caller from intermittently calling the performUpdate function and causing additional processing of calls. Leading to denial of service. The bug can be found at this location

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L279-L300

Notice that is does not have an access modifier.

function performUpdate(address _pool) public {

Also notice that it does not have sufficient require statement that validates the sender.

require(rule != address(0), "Pool not registered");
​
require(
block.timestamp - settings.timingSettings.lastPoolUpdateRun >= settings.timingSettings.updateInterval,
"Update not allowed"
);
​
if (poolRegistryEntry & MASK_POOL_PERFORM_UPDATE > 0) {
_performUpdateAndGetData(_pool, settings);
​
​
// emit event for easier tracking of updates and to allow for easier querying of updates
emit UpdatePerformed(msg.sender, _pool);
} else {
revert("Pool not approved to perform update");
}

Impact

None of the require or if statement conditions validate the sender. And there is no access control modifier. Which means any malicious actor can repeatedly call this function at will. Which can exhaust gas and cause a DoS.

Tools Used

Manual review.

Recommendations

Add an access modifier like onlyOwner. Or add a require statement similar to the following.

require(msg.sender == address(this))
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.