QuantAMM

Summary

Known Issues Section where the permission required for this attack is documented as in-scope.

The InitialisePoolLastRunTime function in the UpdateWeightRunner contract allows pool owners to set an arbitrary last run time, which can be exploited to cause a denial of service in the weight update mechanism. This can be leveraged to gain unfair advantages by the pool owner where they have total control over when the pool is updated.

Vulnerability Details

In the UpdateWeightRunner contract, the InitialisePoolLastRunTime function allows setting the lastPoolUpdateRun timestamp without validation:

A malicious pool owner can set this value to type(uint40).max or any value greater then block.timestamp, which would cause an underflow in the performUpdate function. This effectively prevents the pool from being updated, as the time delta calculations would fail.

The vulnerability is particularly concerning because:

1. Pool owners with the ability to set the last run time are considered untrusted according to the scope

2. The timestamp parameter is not validated

3. The function can be called multiple times thus the attack can be repeated

4. The impact extends beyond just weight updates, affecting pool performance and LP positions

Impact

DOS and **Reintroduce IL (**Impermanent loss) to the pool which is one of the core problems this protocol is trying to solve.

The vulnerability allows malicious pool owners to:

1. Prevent weight updates from executing properly

2. Create windows of opportunity for MEV exploitation

3. Collect fees earlier than intended through likely LP exits

Tools Used

Manual Review

Recommendations

Add validation checks to prevent malicious timestamp values:

The recommended fix:

1. Adds reasonable bounds for the timestamp value

2. Prevents DOS attacks through timestamp manipulation

3. Maintains the intended functionality for legitimate pool operations

4. Protects LP interests by ensuring continuous pool updates