QuantAMM

Summary

In the CalculateNewWeights function, when requiresPrevAverage == false and the numberOfAssets is odd, the last entry in the calculationMovingAverage array is stored without performing 128-bit Min and Max checks.

Later, when the items are unpacked in the _quantAMMUnpack128Array function, this may lead to an overflow/underflow, resulting in incorrect values being returned.

Vulnerability Details

When calling the CalculateNewWeights function, the new moving average is first calculated and then stored in an int128 packed array with overflow/underflow checks applied. There are two scenarios to consider:

1. Previous Moving Average Required:
   In this case, all array data, including the previous moving average, is packed into the int128 array with the necessary overflow/underflow checks.

2. Previous Moving Average Not Required:
   If the previous average is not required and the length of the moving average array is odd, the last index is stored without performing any overflow/underflow checks, potentially leading to incorrect values.

When unpacking the movingAverages array, there is a risk of downcasting. If the value stored at the last index exceeds the int128 max/min limits, an overflow or underflow may occur, leading to incorrect values being returned.

The code at line 377 poses a risk of silent overflow/underflow. If the value being handled does not fit within the int128 range, it will overflow/underflow without any warnings, potentially leading to incorrect results.

POC :

To demonstrate the overflow scenario, consider the following test case:

Run with command : forge test --mt test_overflow_underflow -vvv

Impact

While unpacking the movingAverages and calculationMovingAverage arrays, there is a risk of overflow/underflow due to downcasting. If the value stored at the last index exceeds int128 range, it will result in an overflow/underflow, leading to incorrect values being returned.

Tools Used

Manual Review, Unit Testing

Recommendations

The best approach to mitigate overflow/underflow risks is to impose explicit checks when storing data at the lastIndex. This ensures that values do not exceed the limits of int128, preventing incorrect results during unpacking.