QuantAMM

Summary

The UpdateWeightRunner contract contains a timing check that allows weight updates slightly earlier than intended due to using >= instead of > when comparing against the update interval. This causes updates to occur marginally more frequently than specified in the documentation.

Vulnerability Details

In the performUpdate function, there is a timing check that verifies if enough time has passed since the last update:

The documentation specifies that updates must be performed "more than updateInterval seconds ago", but the code uses >= which allows updates to occur exactly at the updateInterval time. This creates a discrepancy between the documented behavior and actual implementation.

The impact is that:

1. Updates can occur one block earlier than intended

2. The system deviates from its documented specification

3. Weight updates may happen marginally more frequently than designed

Impact

Code does not function as intended.

Medium Severity - Low impact being that funds are not directly at risk but functionality does not work as intended. High likelyhood given that anyone can call this every time the invalid logic case becomes true (every update interval).

Tools Used

Manual Review

Recommendations

Change the comparison operator from >= to > to match the documented behavior:

This ensures that updates can only occur strictly after the intended interval has passed, aligning with the documentation and intended system behavior.