QuantAMM

Summary

Inside the initialize() function:

there is no validation of _oracleStalenessThreshold to ensure it falls within a reasonable range. If _oracleStalenessThreshold is set to a very large or zero value, the contract may:

1. Treat extremely stale data as valid, causing the pool to rely on outdated oracle inputs for an indefinite period.

2. Accept a threshold of 0, possibly preventing any oracle data from being used if the logic checks for time differences strictly.

Vulnerability Details

• https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/QuantAMMWeightedPool.sol#L712

Impact

• Data Manipulation or Inaccuracy: Attackers or misconfigured oracles could exploit an unbounded threshold, letting the pool operate on unrefreshed data for a very long time or prematurely invalidating fresh data.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L360C60-L360C84
https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L372

Tools Used

Manual audit

Recommendations

1. Implement Range Checks: Enforce a meaningful minimum and maximum value for _oracleStalenessThreshold. For example:

Adjust the bounds according to the desired update frequency of your oracles.
2. Document Valid Thresholds: Make it clear in the contract’s docs or comments what an acceptable threshold range is, and why.