QuantAMM

Summary

The QuantAMMWeightedPool contract initializes the UpdateWeightRunner instance without verifying its authenticity or admin control. An attacker can deploy a malicious UpdateWeightRunner contract and gain unauthorized control over the pool’s weight updates, potentially manipulating token swaps and draining liquidity.

Vulnerability Details

Issue: Unprotected External Calls to UpdateWeightRunner

• The contract blindly assigns params.updateWeightRunner as the UpdateWeightRunner instance.

• There is no verification to check if this contract is trusted or deployed by a legitimate admin.

• This allows an attacker to deploy a malicious UpdateWeightRunner that returns a fake quantammAdmin, granting full admin control over the pool.

Exploit Scenario:

1. Attacker deploys a fake UpdateWeightRunner contract.

2. Sets quantammAdmin to attacker’s wallet.

3. Deploys QuantAMMWeightedPool using the fake runner.

4. Calls setUpdateWeightRunnerAddress() to replace the real runner with an attacker-controlled contract.

5. Manipulates weight calculations and pool liquidity.

Example Malicious UpdateWeightRunner Contract

Impact

• Full Admin Takeover: The attacker can arbitrarily change pool weights, affecting swaps.

• Price Manipulation: The attacker can control token ratios, enabling unfair arbitrage.

• Potential Liquidity Drain: If weight updates allow underpriced swaps, liquidity providers lose funds.

Proof of Concept (PoC)

Attack Steps

1️⃣ Deploy the FakeUpdateWeightRunner contract.
2️⃣ Deploy QuantAMMWeightedPool using the malicious runner’s address.
3️⃣ Replace updateWeightRunner using setUpdateWeightRunnerAddress().
4️⃣ Manipulate pool weights to favor the attacker.

Tools Used

• Foundry (forge test) for testing unauthorized admin changes.

• Slither (slither . --detect access-control) for static analysis.

• Mythril for symbolic execution and logic flow detection.

Recommendations

Verify UpdateWeightRunner Before Assigning

• Ensure updateWeightRunner is from a trusted source.

Restrict setUpdateWeightRunnerAddress() to Admins

• Only pre-approved addresses should modify the runner.

Use Immutable Admin Control

• Define an immutable trustedAdmin during deployment.

  address immutable trustedAdmin;

  ​

  constructor(address _admin) {

  trustedAdmin = _admin;

  }